Overview

overview

7

Static

static

3

a3e8f1af76...b3.exe

windows10-2004-x64

7

a3e8f1af76...b3.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 08:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
  • Size 4.1MB
  • Sample260930-kfm4fasfkc
  • SHA256 a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E2D.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2224.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4732
          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4552
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B5.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5560
              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5244
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2754.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2632
                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4440
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29D5.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2052
                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2880
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C36.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3464
                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4656
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E79.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4624
                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:2484
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2144
                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2808
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a328F.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2228
                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2212
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34B2.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:6116
                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1328
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A7F.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:1064
                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5460
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4174.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1364
                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3580
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4472.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5932
                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2864
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46C3.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4224
                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:248
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4982.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5684
                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4264
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B76.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1996
                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4232
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D99.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3236
                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4852
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5039.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:556
                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4908
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a527B.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4856
                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3556
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a547F.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2504
                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2380
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5598.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1116
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2708
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56B1.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3684
                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4544
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a579C.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:840
                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6056
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58A5.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1944
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4704
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5990.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4740
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1500
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A99.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5924
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3208
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B84.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2388
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:6096
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C7E.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5004
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1528
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D68.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1128
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:3080
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E72.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:4448
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5360
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F3D.bat
                                                                                                                              62⤵
                                                                                                                                PID:2768
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:3016
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6037.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:3144
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:5348
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6102.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:5000
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2180
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61DD.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:5972
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:2996
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:2336
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3884
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63A2.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:2416
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2860
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a647D.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3004
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:3184
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6538.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4212
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:5600
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6613.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:2200
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1412
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66FD.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:1868
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:2936
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67B9.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:1472
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:3560
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6865.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:5860
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:4892
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6920.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5400
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:1848
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69FB.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:4996
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:2856
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AE5.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                              PID:4924
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BC0.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:5748
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5628
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CAA.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:3244
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DC4.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:5756
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5896
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EFC.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                  PID:5252
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FC7.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                        PID:1960
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70B2.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4200
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71CB.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:5864
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72A6.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:6060
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:2956
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3308
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a744C.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                PID:568
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:1912
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7526.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:2124
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:564
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7630.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                            PID:2584
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a770B.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                PID:5568
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77E5.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:4260
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78B1.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3836
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a796C.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:244
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5988
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A66.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:5236
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B12.bat
                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2B.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DA2.bat
                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:5308
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:944
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E6D.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                      PID:4004
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:2688
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F19.bat
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:3056
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                              PID:1756
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FE4.bat
                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                  PID:2152
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:1548
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:5364
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                              PID:3724
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81F8.bat
                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:1616
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:956
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:5224
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a835F.bat
                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4432
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83FB.bat
                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:5616
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                PID:5596
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84B7.bat
                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                    PID:872
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:1864
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8543.bat
                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1680
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:5180
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85E0.bat
                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:4832
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a868B.bat
                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2596
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:3384
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8718.bat
                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5152
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4688
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87A5.bat
                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4148
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8822.bat
                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3500
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88CE.bat
                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:4296
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A83.bat
                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B00.bat
                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9001.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9263.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a933D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9486.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9541.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a981F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9987.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                      28⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:2108
                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                        29⤵
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:4500
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                          30⤵
                                                                                                                                                            PID:4756
                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                    C:\Windows\Logo1_.exe
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Enumerates connected drives
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Drops file in Windows directory
                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6052
                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                      3⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3988
                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                        4⤵
                                                                                                          PID:4772
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 1000
                                                                                                        3⤵
                                                                                                        • Program crash
                                                                                                        PID:1708
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 6052 -ip 6052
                                                                                                    1⤵
                                                                                                      PID:1964

                                                                                                    Network

                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          $$a1E2D.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a1E2D.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 7947e4039a261ca82651d78be9f59ea22d442c96e5b4783bc6b8a7646c808796
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a2224.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2224.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 f7f3134d7a9fb6df71968f330579e68b27619632e537320fb1cb346c27c347e7
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a24B5.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a24B5.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 fedbcc6d3e67b14e039b68e1b765f867b96afd6f99b209780f725d5cadf09c96
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a2754.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2754.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 242b68deca04efa1664573f76072d498464cc3920453a9c9874a21cfe74f19fe
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a29D5.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a29D5.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 7c4e94a1c1ffe3e3bf089fa13a26eb94096915e1fcf67a9ff6ea03641448705c
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a2C36.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2C36.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 04a08f3594e81c447861fb93863f149d2b473b42eac65a30b138f21bd9a9a1c1
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a2E79.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2E79.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 0d719d95d1f71f61dcf192457129c578b6251a7be1c5ae50e1b06eabdb20e423
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a309B.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 c6b369900fec4ff4540d105914955c9b3b334218e64e4bd8effe1e10c617fca7
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a328F.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a328F.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 492cc0c11e055a59d5366bd78b02cf3998a3aa2b76ee3cdf5baff00c4a652d64
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a34B2.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a34B2.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 6777e9cdf0739e5eec6df1ac53ab1e16ea7597924cbf8b192d9450505d100a23
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a3A7F.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3A7F.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 4b726cc5cbe3ca8adb8e26558a09e478f34dfe241b4928d2bcf931bb362736ea
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a4174.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4174.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 bf818e387ebdb57e07e42891d56a377ceea9313d052623dcf06d9639a383da9f
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a4472.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4472.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 95879023040e27ade9e77fbec4b1126318d4001efe74aa84f6dd8958268eea64
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a46C3.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a46C3.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 4841a22aab4804da81ee557a4b1e8bdd21f8b825a0fa1e6383a25f3db32a9e6c
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a4982.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4982.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 082d5242a4a207893df2b91e6e750ed5407ad8513ae40f99336b275e0d31356d
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a4B76.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4B76.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 5a585942d85d8a1a53d6814f95eac16e7b99a169bcfb661241b1bbe3748e0167
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a4D99.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4D99.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 47430cccbf769dd80906641951b9a3dc93139120132659316b13b6e2e3da3874
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$a5039.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5039.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 33e69d59e0b461d7b6dd7e7dfb1818d51ec6c4249112b2160fa08465436d5a43
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.7MB
                                                                                                          • SHA256 60c6a38afd0aed6e240a2246f0595cf253a45ae1a77dfd658c923a3ca214eb41
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.6MB
                                                                                                          • SHA256 7d887e9f0e257c8204fea574e5c69e03ffc212c36052e448b32b65a310a3ce15
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.7MB
                                                                                                          • SHA256 1d0326305fafbcd2f38edee1a120fa2dfadb8c94db7853fcded18e58a9af3cbc
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.6MB
                                                                                                          • SHA256 51871565a4a43b1a40af1ddb6d952823f0bb676ae097f1de6b7a75ec1e059f7f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.5MB
                                                                                                          • SHA256 719cc13b4ccd82d0ab277287b9b4d816779277f11087f43b0080c0ee8316d94c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 4.0MB
                                                                                                          • SHA256 757e50e41674f07aad751c50164b67cb0e8bb589b2559c4e17c690c5f1b38b55
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 4.0MB
                                                                                                          • SHA256 b6d15bd85bc0a92ff4bf86ecf16c119ff2bc994515b40194b5a8749fb969cb22
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.6MB
                                                                                                          • SHA256 a0a1018b7683b3e8a4469a757108e3dd4779d07a40d9d5b76814c80e81617265
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 4.0MB
                                                                                                          • SHA256 d677af64a4479cddda9d41eae852db06622d49f5788b0f0c08c83cdb17f65e48
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.9MB
                                                                                                          • SHA256 28898ea0229d70b66a5be32b0ae711a14f0385560d57fc8fa7466b99d86fe89f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.5MB
                                                                                                          • SHA256 68c59f55d966694e065448d78ed182a46bf347fbee75f7d35703f2f7a7ae7dd8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.5MB
                                                                                                          • SHA256 bfb42ef1f412ac3e3289ab853323818c5fb4145f505a57e23321ee006604d6c5
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.9MB
                                                                                                          • SHA256 2ce479df7631300966eea607ee6a58b6efb2db0c143e22f085f4b7752ef2d969
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.9MB
                                                                                                          • SHA256 bce3b36632d17eedccd28e107a5c01110f70f145d7d5dd102f48fa124bd35a0b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.8MB
                                                                                                          • SHA256 74c17946163f2dc0545e5d15a78c98de2bc38ffa23b4bba2d3736d42fe2172a9
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.8MB
                                                                                                          • SHA256 81860a35a550149d10c7588999906eff0008474b080c56c61bef37ebbbe1d931
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.8MB
                                                                                                          • SHA256 3b5b8a5e7b34e29e7b909275572794d4afd30154d90ade984122e5560da3c270
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\a3e8f1af762cd97356f42c0161510bcc620c8a0b9bc1adb1f4447da22e5195b3.exe.exe
                                                                                                          • Size 3.7MB
                                                                                                          • SHA256 55fa6a971204d1c4ed8080e0821cc9c5e6d0e0492177b9fde005c6fe58681d70
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Dll.dll
                                                                                                          • Path C:\Windows\Dll.dll
                                                                                                          • Size 68KB
                                                                                                          • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Logo1_.exe
                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                          • Size 32KB
                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          _desktop.ini
                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-1262770251-41185387-1005173349-1000\_desktop.ini
                                                                                                          • Size 9B
                                                                                                          • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          memory/248-1387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/564-1611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/944-1659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/988-1803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1172-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1172-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1196-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1328-536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1412-1529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1500-1459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1528-1474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1684-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1756-1671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1848-1549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1864-1719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1876-1773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1912-1610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2068-1580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2080-1827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2092-1943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2108-1444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2108-1570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2136-1767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2156-1821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2180-1499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2212-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2340-1901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2380-1433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2424-1749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2444-1791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2456-1907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2484-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2584-1616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2688-1665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2708-1438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2808-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2816-1863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2856-1554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2860-1514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2864-1376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2880-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2896-1925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2936-1534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2956-1600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2996-1504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3016-1489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3040-1845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3048-1871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3048-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3064-1677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3080-1479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3184-1519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3208-1464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3216-1950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3216-1944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3244-1569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3308-1605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3360-1913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3384-1737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3500-1755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3556-1428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3560-1539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3580-1361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3628-1919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3668-1695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3712-1937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3724-1689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3772-1851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3836-1631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3884-1509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3976-1653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4012-1883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4180-1621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4200-1590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4232-1405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4252-1839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4260-1626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4264-1395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4296-1761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4440-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4444-1559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4472-1585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4520-1815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4544-1443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4548-1647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4552-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4564-1833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4628-1785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4644-1889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4656-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4660-1797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4668-1809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4688-1743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4704-1454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4728-1931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4832-1731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4852-1415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4892-1544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4908-1423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4912-1779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4932-1877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5180-1725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5224-1701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5236-1641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5244-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5348-1494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5360-1484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5364-1683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5460-1353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5596-1713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5600-1524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5628-1564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5788-1895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5828-1707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5864-1595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5896-1575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5988-1636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/6052-1362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/6052-274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/6052-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/6056-1449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/6096-1469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download