Overview

overview

7

Static

static

3

6153385f1a...fb.exe

windows10-2004-x64

7

6153385f1a...fb.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 07:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
  • Size 6.0MB
  • Sample260930-htw76attaz
  • SHA256 6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a390.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6084
      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a882.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5524
          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3000
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC89.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4900
              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3592
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1004.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4896
                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4560
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1330.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4952
                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:304
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a167C.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3764
                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2852
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2244.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:6076
                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5160
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2689.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4884
                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2616
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a290A.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3996
                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:5364
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:2788
                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5264
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4236
                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5768
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33B8.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1504
                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1812
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3697.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5360
                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4200
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3568
                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2792
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C92.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5104
                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5088
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F70.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3248
                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3400
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a423F.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4140
                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4996
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4481.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5268
                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3512
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4760.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3396
                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5072
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49D1.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1724
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5596
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AAB.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5544
                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4876
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BB5.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4396
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1924
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CAF.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5964
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5092
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D99.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3080
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5412
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E93.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1208
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5112
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FEB.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4496
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4820
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5172.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1972
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1180
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52BA.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3324
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1816
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53C3.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:584
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4212
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54EC.bat
                                                                                                                          60⤵
                                                                                                                            PID:6028
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4380
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55F6.bat
                                                                                                                                62⤵
                                                                                                                                  PID:444
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:252
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5700.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:2168
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2732
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57DA.bat
                                                                                                                                            66⤵
                                                                                                                                              PID:1548
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                67⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5312
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58E4.bat
                                                                                                                                                  68⤵
                                                                                                                                                    PID:2144
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                      69⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4588
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59FD.bat
                                                                                                                                                        70⤵
                                                                                                                                                          PID:4156
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                            71⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:4944
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B07.bat
                                                                                                                                                              72⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4764
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                73⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:3624
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BE2.bat
                                                                                                                                                                  74⤵
                                                                                                                                                                    PID:1532
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                      75⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:3404
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CEB.bat
                                                                                                                                                                        76⤵
                                                                                                                                                                          PID:4240
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                            77⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:2348
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DC6.bat
                                                                                                                                                                              78⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:4116
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                79⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:1472
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ED0.bat
                                                                                                                                                                                  80⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:844
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:1376
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FE9.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1264
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:6092
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6121.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                            PID:3440
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:632
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a623B.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                  PID:4192
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:2096
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6354.bat
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                        PID:3044
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1404
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a642F.bat
                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:2400
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5588
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6519.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                  PID:5708
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:1412
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6613.bat
                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:1756
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66EE.bat
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:3172
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:1932
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67C8.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3116
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:716
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68E2.bat
                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:1056
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69BC.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:2296
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                              PID:3352
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BA1.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                    PID:4940
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:952
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C7C.bat
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                          PID:772
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:5976
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D56.bat
                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:1360
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E31.bat
                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5184
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EED.bat
                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                        PID:2076
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3304
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FC7.bat
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:3808
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70B2.bat
                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:3224
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a719C.bat
                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1204
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:4336
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7286.bat
                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:1500
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:1164
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:5252
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:5560
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a744C.bat
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                      PID:1468
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                          PID:1084
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:6088
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:3480
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a766E.bat
                                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7778.bat
                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7834.bat
                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                  PID:2344
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78EF.bat
                                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79CA.bat
                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AB4.bat
                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                              PID:5316
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4388
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B8F.bat
                                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5480
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5584
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C5A.bat
                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4912
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D44.bat
                                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1168
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:4720
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E2F.bat
                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:5772
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6044
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F29.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:1660
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FE4.bat
                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:3376
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4736
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80BF.bat
                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:1664
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1356
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a819A.bat
                                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4792
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a834F.bat
                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8563.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a861E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8776.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8822.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8ED8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a904F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a910B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a933D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a964B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9716.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a986E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9939.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E0B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA00F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA241.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA31C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA464.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA520.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA648.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA704.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA791.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA82D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAABD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB07A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB193.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB220.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB29D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB349.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB471.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB879.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB905.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC01A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC097.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC191.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1396
                                                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                              PID:2512
                                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                      PID:4908
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:5912
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1012
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                          PID:2504
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 976
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                          PID:772
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4908 -ip 4908
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:1180
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4908 -ip 4908
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4908 -ip 4908
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:5704

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                $$a1004.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1004.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 60973bb43c61e6f6499a51a7cd1ddff98e2f403784f31607ea9f0cf6dd9bf77d
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a1330.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1330.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 6c10c3a7d61d7ffa52b072aa9f5c6668c347f31a1c817ce773f3c3175f30211b
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a167C.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a167C.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 aab17ceabb5a49413ae42a64f7bc4f3d10557c9a71be6431e5215c3246945e36
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a2244.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2244.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 f7ea80378d321daf60986109a47dc1041de1a9c7a105d44639d7ccb129fa8e92
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a2689.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2689.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 7c408a65702e3b292135a9a498782d94328fea8c2804c5247c5e762f3499aa36
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a290A.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a290A.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 9fc2192478be199ed784d600a9f7791c0f7555bd3f9ee8f14bb91797956c0688
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a2DEC.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 3ca985c8aa68ec8dfb815300a81a4c34694394e0dbb4c42716fa30f3da7d8d04
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a309B.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 bb5402295d325ab08a98df9c591b1cb0dc989235f3e769d60cbe460163d18ff5
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a33B8.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a33B8.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 db1add9914ff210b0b8bd2307b752dbe5ae626224248b0522bfdc13d38ede80f
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a3697.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3697.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 aa9366b9ceb3e2ceacd77ec64187374649cbec52ea5c14ae896f8803f774cafb
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a390.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a390.bat
                                                                                                                                                                                                                                                                                • Size 721B
                                                                                                                                                                                                                                                                                • SHA256 949d87912af22e990307f665b450e4d529d6da54fd532988d5a7bc67a4bed12d
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a39A4.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 4839dd3ac2ff2646087208a652c160510572e8062819d47650ba5dc1d3ac74e6
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a3C92.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3C92.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 6a908841a684d00ab607f1389e0ec13ea068fc25d59317e5071bae1bee1a45ef
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a3F70.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3F70.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 92add80995dc59a88b87549ed3aec4b654d39ae3cfc2fa66be5a96e0263cf903
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a423F.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a423F.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 988417078711c4187e0e0b23f1640f3c85e900594db777275a3120f67f0bf103
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a4481.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4481.bat
                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                • SHA256 f73e11c3ddd0f2320433377a84d62a4e8d4a569f0abfa00ce0e4e5605e52ec2c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$a882.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a882.bat
                                                                                                                                                                                                                                                                                • Size 721B
                                                                                                                                                                                                                                                                                • SHA256 d758a3feceb312805e118fb68a5293807a6b03097af69056a5c233dc12bef93d
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                $$aC89.bat
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC89.bat
                                                                                                                                                                                                                                                                                • Size 721B
                                                                                                                                                                                                                                                                                • SHA256 bfb3dc00f080fc02afe9940772d2a16c9afe470ad365346644d8a6ac2f4a6bef
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                • SHA256 7931d7cc18a9ad8802f1ea67b1326d62e1cc89692ea17f90bc9d910f6620fa03
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                • SHA256 04226cfc6217e9ed22a048e2eb56ba156495f7cc3d6bf133a47e11982d0139e3
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                • SHA256 d082af5c0ec834a89f3f071d3e94250134a867dad8925ec4e42c5ea8f7f638d4
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 6.0MB
                                                                                                                                                                                                                                                                                • SHA256 b2535ddeab698a66bf16519dd226cde1ad01ab43367d9f9252feda6c0d9a9c12
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 bad3c10bf73e82b2e363e18fddac5677559f35a04f464b3821d30cca1f7aec65
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 6.0MB
                                                                                                                                                                                                                                                                                • SHA256 3900960f13feb4e326ba0f2148c5786b5f5d3c007ebbe44b71fa2f6b302be025
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.9MB
                                                                                                                                                                                                                                                                                • SHA256 29f985a8b57889bd3b012d93bb8043e3d8c4c21809e80968845f646ad1582011
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.9MB
                                                                                                                                                                                                                                                                                • SHA256 fd69b76bfc083c07ad75c4a5dc1f9de2367789dd6b6d8656d9dd4e9007fb9d0c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 09f8492aa82df9c1ab7363275fcb0df8cb325d6e869fc774a43db163166cde74
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.9MB
                                                                                                                                                                                                                                                                                • SHA256 76d2cb9063170191c5b58ee84e182a8e424602f4ae45e14c80946fd7e83b493d
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.9MB
                                                                                                                                                                                                                                                                                • SHA256 7a45d7fff7028052bfcd1bc13290d575a67e932bf08fe8bc5d8d865271fbc80c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 69433c12917acfeeda5344bb395a9ed7c28a85175ae3d15dc52680de2ca34969
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 cb9377f33ecaf7f80d8c3082f317ad16bda00859242c4086b45e81da20acbeb5
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 dba409b2e897e212b0a87629d1c45755d86f5e76b890ad30e947f42a56689835
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                • SHA256 f50e5f74b898557b84f2caccbc7812d4f2610827eea3414391645d7f88a0da69
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.6MB
                                                                                                                                                                                                                                                                                • SHA256 00cd17f89b7ef0e37a32a8afebd83bb7a829f58d494dcb0b096ff163cc606846
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 0151b2fd2e44ce2d45a5a7a606ae18bee52cf3d2037ed1fd93a9f59781b5c088
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6153385f1ac0adb30fc99fb5c1e0e67089605bec0208cb97bf147b153c8fe6fb.exe.exe
                                                                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                                                                • SHA256 3a448003f8a285e7491fcecc46657ff3a8b94c93bfca1b1adfe3a6c95ee68828
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                Dll.dll
                                                                                                                                                                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                • Size 68KB
                                                                                                                                                                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-696679853-3915825385-3233721679-1000\_desktop.ini
                                                                                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                                                                                • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                memory/204-2330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/252-1723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/256-2324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/304-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/420-2233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/628-2191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/632-1778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/716-1813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/808-2300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/952-1833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1036-2101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1048-2023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1056-1818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1084-1884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1092-2239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1096-2246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1148-2137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1164-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1180-1702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1276-2185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1304-2384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1356-1969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1376-1768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1404-1788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1412-1798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1472-1763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1488-2252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1544-2354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1580-2270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1684-2011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1708-1896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1804-2041-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1812-1607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1816-1707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1924-1676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/1932-1808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2004-2215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2088-2209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2096-1783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2264-2167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2276-2366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2296-1823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2344-1908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2348-1758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2504-2047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2576-2095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2592-2155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2612-2131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2616-1561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2704-2173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2732-1728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2736-2143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2740-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2740-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2764-2312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2792-1623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2852-1531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2956-1957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/2960-2161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3000-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3004-2125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3008-2390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3012-1713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3012-1656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3084-2017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3112-2396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3144-2258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3152-1828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3224-1863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3272-2083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3284-2402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3304-1853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3348-2065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3356-2348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3388-2288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3400-1639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3404-1753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3436-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3480-1890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3508-2276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3512-1655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3588-2360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3592-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3592-1566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3596-2414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3624-1748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3652-2408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3768-2149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3808-1858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3860-2227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/3924-2203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4008-1999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4144-2005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4160-2119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4196-2342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4200-1615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4212-1712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4248-2294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4316-2336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4336-1868-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4380-1718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4388-1926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4392-2378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4560-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4580-2197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4588-1738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4608-1975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4616-1848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4668-2029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4676-2306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4720-1945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4728-2221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4736-1963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4804-1920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4820-1697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4872-1803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4876-1671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4908-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4908-1514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4908-1564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4912-1939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4928-2107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4944-1743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4972-1902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/4996-1647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5008-2318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5024-2264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5032-2059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5072-1661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5088-1687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5088-1631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5092-1681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5112-1692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5160-1553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5264-1587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5300-2372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5312-1733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5364-1579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5384-2089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5412-1686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5560-1878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5584-1933-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5588-1793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5596-1666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5764-1981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5768-1597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5804-2282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5812-2113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5872-2077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5900-1987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5928-2179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5932-2035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5940-1993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5956-1843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/5976-1838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6000-2071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6044-1951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6056-1914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6092-1773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                memory/6136-2053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                Download