Overview

overview

7

Static

static

3

a9eaf0ad9c...a0.exe

windows10-2004-x64

7

a9eaf0ad9c...a0.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 06:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
  • Size 4.6MB
  • Sample260930-g8f9tagh52
  • SHA256 a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5D9.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4084
      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5276
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD915.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3732
          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5044
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDF7.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5028
              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1344
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE039.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2392
                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1364
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2AA.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2204
                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3192
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE53B.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:6032
                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:832
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE79C.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2256
                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4964
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA3C.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4976
                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4844
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECAD.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4212
                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3136
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF25A.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:248
                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4196
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA1A.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5588
                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:5872
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC4D.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3400
                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2548
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a594.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4660
                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1760
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1236.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4280
                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5624
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14A7.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1484
                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4308
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a193B.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4284
                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2504
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BAC.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:828
                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3712
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DFE.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3152
                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5316
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20CD.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2508
                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3260
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ACF.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3584
                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3348
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C65.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3692
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4432
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E69.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4656
                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1260
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F53.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2500
                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5352
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a304D.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1924
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1656
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3176.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1596
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1384
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3251.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1952
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1964
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a334B.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4564
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2596
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3435.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1412
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3032
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a354F.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5612
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5084
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3629.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:6036
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4440
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3733.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4456
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5948
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a380E.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:3100
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:1172
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38D9.bat
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2692
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2084
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39B4.bat
                                                                                                                                          68⤵
                                                                                                                                            PID:3852
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5144
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A8E.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:4568
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3764
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B69.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2888
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:5244
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C63.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:5064
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:5508
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3868
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2540
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E28.bat
                                                                                                                                                                78⤵
                                                                                                                                                                  PID:4724
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:1080
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F13.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:2772
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:5500
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FFD.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:5168
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:2668
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40F7.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                  PID:560
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:3140
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41C2.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:1328
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3112
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42DB.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:5912
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:2808
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4397.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5832
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:860
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4452.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:4460
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a451D.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                        PID:3380
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:6080
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45D9.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:5876
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46D3.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                  PID:5248
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:2672
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a478E.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2560
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4869.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:4392
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:1732
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4963.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:2164
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A5D.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B48.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4856
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:5100
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C13.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CFD.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                  PID:1688
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:960
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DE7.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:5396
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EB3.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:3068
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F8D.bat
                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:2688
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:1516
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5049.bat
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:1948
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5104.bat
                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:3812
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:264
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51CF.bat
                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2212
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a527B.bat
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5337.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:2424
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5412.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3236
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54DD.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                      PID:3504
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55B7.bat
                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5683.bat
                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4760
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a574E.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5416
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5819.bat
                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58C5.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:4836
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5971.bat
                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                    PID:3636
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:3324
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A5B.bat
                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:3960
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B16.bat
                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:4600
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BE2.bat
                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:2704
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:5348
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C9D.bat
                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5112
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                          PID:956
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D39.bat
                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5764
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2816
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DE5.bat
                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5460
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:2876
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E81.bat
                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:2412
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F2D.bat
                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:2860
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:5748
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6008.bat
                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:120
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3080
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60A4.bat
                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5504
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a616F.bat
                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a621B.bat
                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:788
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a644E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6529.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a675B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a697E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AE5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6ECD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7054.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a711F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7517.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7611.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7778.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BCD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8090.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a812C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8265.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8320.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8469.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5516
                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                          2⤵
                                                                                                                                          • Creates a file in the Startup directory
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:4464
                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                            3⤵
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:1360
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                              4⤵
                                                                                                                                                PID:3340

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                              Reconnaissance

                                                                                                                                              Resource Development

                                                                                                                                              Initial Access

                                                                                                                                              Execution

                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                              1
                                                                                                                                              T1059

                                                                                                                                              Windows Command Shell

                                                                                                                                              1
                                                                                                                                              T1059.003

                                                                                                                                              Persistence

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Privilege Escalation

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Defense Evasion

                                                                                                                                              Credential Access

                                                                                                                                              Credentials from Password Stores

                                                                                                                                              1
                                                                                                                                              T1555

                                                                                                                                              Credentials from Web Browsers

                                                                                                                                              1
                                                                                                                                              T1555.003

                                                                                                                                              Unsecured Credentials

                                                                                                                                              1
                                                                                                                                              T1552

                                                                                                                                              Credentials In Files

                                                                                                                                              1
                                                                                                                                              T1552.001

                                                                                                                                              Discovery

                                                                                                                                              Peripheral Device Discovery

                                                                                                                                              1
                                                                                                                                              T1120

                                                                                                                                              Query Registry

                                                                                                                                              1
                                                                                                                                              T1012

                                                                                                                                              System Information Discovery

                                                                                                                                              1
                                                                                                                                              T1082

                                                                                                                                              System Location Discovery

                                                                                                                                              1
                                                                                                                                              T1614

                                                                                                                                              System Language Discovery

                                                                                                                                              1
                                                                                                                                              T1614.001

                                                                                                                                              System Network Configuration Discovery

                                                                                                                                              1
                                                                                                                                              T1016

                                                                                                                                              Lateral Movement

                                                                                                                                              Collection

                                                                                                                                              Data from Local System

                                                                                                                                              1
                                                                                                                                              T1005

                                                                                                                                              Command and Control

                                                                                                                                              Exfiltration

                                                                                                                                              Impact

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              $$a1236.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1236.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 e3a18ddbccc2b25fa0ccc49ebf3e6f0998830f3ec513ca5d02fe78c0a3716ec2
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a14A7.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a14A7.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 84ebad161d3fa5146370c37b3d7105d8dfda37be10e8beafda449208b8fc9b9e
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a193B.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a193B.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 878816badab9a17104f23cd8d9bbea8d8b8244eebc5d867ef234713e3f31aa91
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a1BAC.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1BAC.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 f72860648aae68f5c9d58e4070e9f5a459377f439283d673952ffff6eb5d10d6
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a1DFE.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1DFE.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 b5adf9d380c80e4ec1349e8ac3a56ed875c6cfd6eb876cb456f6471ffe531d15
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a20CD.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a20CD.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 ec55a02595993e877ce24e0603f9915a73e28abbd3bb1fc6b7a06e7924fb12e0
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a2ACF.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2ACF.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 c7bea9320aa3b8294de6fc90769dda6110797b49df482d831d58a4e6b3d658f0
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a2C65.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2C65.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 94a9316098963a23425f46d64eeaa735797c8e270b4db95db9172ee6dd1d3ee2
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a594.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a594.bat
                                                                                                                                              • Size 721B
                                                                                                                                              • SHA256 bc996e38a5ac63aa4f47c16a66723e91f2c80d6c3e52c5200021c9c7c1a4c8e7
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aD5D9.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aD5D9.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 24fc33f0bbfa4f0ddc37e907dc84a5046a82d7ef54aa5d7d870f6e4b12827936
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aD915.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aD915.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 dd142adcae3ba48cc317efabdb3ad76c5d20ab0363951b37bc6aa69370ec9cf5
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aDDF7.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aDDF7.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 71174933d3b37d0efd047f5896688e73cbdd37538ec2f01f18495d346b1dabbb
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aE039.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE039.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 7cc4d48ebea2074b2525e3f83c0cdf155d7791a436a7d321ceb0c85a1a66e66a
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aE2AA.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE2AA.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 4fd71edeb7b48db9d3c25defcdd7a969a56fbfe709629cfef22136214b2515fb
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aE53B.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE53B.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 cfc5d9628ac9cd38f62c2f875938dd05249d0abf2cffd721001e52c2a5e6f29e
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aE79C.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE79C.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 28d3a66c2050fdd8a571b6ef3d37e2db33b121645a896959d999e3a09b3aca53
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aEA3C.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aEA3C.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 34fbd0ba22bd6ced4991916ae65f7a10bab8ec4ed7d3dfc0ce9ca8a108321465
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aECAD.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aECAD.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 b6ed706da2453d475edae60609e037706cf520b37a71a150934f0291bc142f08
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aF25A.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aF25A.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 82f40a19134a41a6f06c5d6e77e745346cd45718874b35329733109a0900bb14
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aFA1A.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aFA1A.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 1a6bdad3eeb217f26ffb4a6f0e3c9554ee430c5602753b035c212071bf3815ab
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aFC4D.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aFC4D.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 8bb7b75ff328d2dbbfe061040432d1a123451dac9169ec729cdf7c0c43b09f8a
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 b9cfee4578d1921c861494968a7d7abed3212ca193327aae93902505f4737d26
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 429fdf986f72f90938f13ed28255c0372e6f866ce3721c652391e11966fee52b
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 d5351b5388bd04043185c64863b5a1a1aa331c3f2a8f62c67ff459648350afde
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 5e77e9cfe4c0d4c79ea07d372a12f8348048f9bb972728743b209fb8946e03db
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.0MB
                                                                                                                                              • SHA256 8dddb9d0f7c06c3e1e19c70c8f638b49c418c96d89e9c7523713bdfbe8d1ccef
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 122f38e99f9b2df675492e39e0bd50ac851381d8d9a1c604fe17d3e3ca11f7ff
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.0MB
                                                                                                                                              • SHA256 e84ea85e356cb9f066ef9fa9850497f2de596af5ab0a77e95f8c0687ad06b675
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 09099726130fe5c4b78eeff263f5acc75c79025b1acea7ff8cd13fb7b74cd708
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 89c0456788f2c803ec9504a5ee2a35343059c37393fdb34a9cbc7c58e88eab8b
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.6MB
                                                                                                                                              • SHA256 2c7c39372f4646630bac43f58e7c8985d07f874cd87c51550e0998280bd3571d
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 2b146eb1d3bddfc2eb0640ec6949d8e667bae82ade509c3ac51a671fe51cfc2f
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.6MB
                                                                                                                                              • SHA256 4e0935158509a291ef785896078919b227d731006297a8cf3b5a1866f5626f45
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 939bc49f8fa10086b1ab3f9a49bd8b3b385ccef33cfde53572f4b358681b0891
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 d7f94ea8032ea861446acd7a4d96e8ec39ea9995cfe4c66ae0a0788952758d10
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 f1b5a67a5e6d40c5540b2b4fcf43b4fc2c03f3467d40e819b700b9b662206aa9
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 aa9fe1ad29d432caed281136e29aa6e69dd51934a14a752b214b9635db474880
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 b7e639c2a17fa6f6b1735b82472c27efd961fedde35c972a2536935e3995206e
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 fce4b12a7034964e8bb982ecfa8c4816981da9aba5e68b3be613eefa07c5e817
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 7f9861ae12061acfc3dc042fc5a8aee9d0a0d54e204c5a7192b577090a702cfb
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a9eaf0ad9c536767c75aa511cedb6643210519b0f358770001baafaca31acaa0.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 5e5e66ba89a9284787bbe944077d3eb4183aa4e96c2187a8588e1b5c75b1ecfb
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Logo1_.exe
                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                              • Size 32KB
                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              _desktop.ini
                                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-2304238888-3968896904-642854331-1000\_desktop.ini
                                                                                                                                              • Size 9B
                                                                                                                                              • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              memory/264-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/620-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/716-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/788-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/832-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/860-8212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/916-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/916-8715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/956-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/960-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1004-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1052-8217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1080-8182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1100-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1172-8147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1208-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1260-8097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1268-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1344-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1364-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1384-8112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1400-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1472-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1516-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1656-8107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1728-8606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1732-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1760-5591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1812-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1836-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1860-8648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1948-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1960-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1964-8117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1996-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2080-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2084-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2156-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2212-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2292-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2504-6077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2540-8177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2548-2999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2560-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2572-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2596-8122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2616-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2668-8192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2672-8232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2760-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2792-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2808-8207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2812-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2816-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2876-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2936-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3032-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3068-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3080-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3112-8202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3136-1045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3140-8197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3180-8227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3184-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3192-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3236-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3260-8075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3324-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3348-8083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3356-8600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3472-8582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3520-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3708-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3712-6089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3760-8666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3764-8162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4088-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4112-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4172-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4180-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4196-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4196-6064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4220-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4252-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4308-6069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4324-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4352-8594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4432-8091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4440-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4464-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4464-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4464-2276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4464-228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4464-6947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4560-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4616-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4720-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4760-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4776-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4776-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4792-8696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4844-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4848-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4852-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4876-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4920-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4964-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4972-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5044-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5080-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5084-8132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5100-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5108-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5140-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5144-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5244-8167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5276-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5316-6197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5332-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5348-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5352-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5372-8247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5416-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5432-8708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5500-8187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5504-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5508-8172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5616-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5624-8092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5624-5599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5740-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5744-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5748-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5836-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5872-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5948-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5956-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5984-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6044-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6080-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6100-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download