Overview

overview

8

Static

static

3

dad942968d...da.exe

windows10-2004-x64

8

dad942968d...da.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 08:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
  • Size 6.1MB
  • Sample260930-ktxvss1vfv
  • SHA256 dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5776
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC75D.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2488
          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4280
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDB6.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2620
              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3588
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD344.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4160
                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1352
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5796
                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2036
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1496
                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1576
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFE4.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2844
                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4896
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE7B.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4276
                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1544
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC07.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5780
                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3912
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18AA.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2984
                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3888
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2636.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1664
                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:5568
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a347F.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:6104
                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3744
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4121.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4040
                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5516
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57E5.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2572
                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:624
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a693B.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2028
                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5556
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D61.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4652
                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2744
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7447.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1156
                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3444
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C07.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:440
                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4712
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82BE.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5212
                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5492
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8984.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4228
                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1984
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9116.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4020
                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:940
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BD4.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3292
                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3020
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CED.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5392
                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2116
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E06.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1912
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5824
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F7D.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4336
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2608
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA097.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1380
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5620
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1FE.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:240
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4964
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA336.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1404
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4120
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA49E.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3356
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5044
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA605.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3620
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1084
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA79B.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4668
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5004
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8B5.bat
                                                                                                                                  64⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4908
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1116
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9DE.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:5236
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4836
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB35.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:5012
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1648
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC3F.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:5864
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1628
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD87.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:244
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:424
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEA0.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:3768
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:120
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFE8.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:1072
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1232
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB131.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:5036
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1228
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB24A.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5172
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:5624
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB363.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:3572
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:4084
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB48C.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:5660
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:2112
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5D4.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:3628
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:2964
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6DE.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4116
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7F7.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:1960
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB92F.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:6068
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1A.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:2640
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB43.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:2616
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:2692
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC5C.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3172
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD75.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:4772
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE7F.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:5480
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF79.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:3012
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC092.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:2368
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC19C.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                        PID:5056
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC276.bat
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                              PID:5380
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:3568
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC361.bat
                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                    PID:4044
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC48A.bat
                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:2364
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:4400
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC564.bat
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4380
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC66E.bat
                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                  PID:4516
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:4776
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72A.bat
                                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:1456
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2888
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC814.bat
                                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:2212
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8FE.bat
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:5836
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:3764
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9D9.bat
                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3516
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    PID:5744
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAB4.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                        PID:2800
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                            PID:1328
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBAE.bat
                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                  PID:1424
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCB7.bat
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                      PID:252
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDB1.bat
                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                              PID:3100
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEAB.bat
                                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                                      PID:4092
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                                          PID:1612
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFA5.bat
                                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:3752
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                                PID:3864
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0CE.bat
                                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:5220
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3280
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1D8.bat
                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3080
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4200
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2E2.bat
                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD41A.bat
                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6132
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD524.bat
                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1360
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5FE.bat
                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3212
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6E9.bat
                                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:4056
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEC8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE188.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE272.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE36C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE427.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE773.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE82F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF195.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF27F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF416.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF59C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF677.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF752.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF80D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDAB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF31.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a125.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a396.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a694.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a924.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE25.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1077.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1104.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a125C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a146F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a154A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1605.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a178C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1857.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1980.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D68.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1ECF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2046.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a218E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a221B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2353.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a249B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2557.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              356⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                357⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4012
                                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:2940
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                            PID:4124
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:1960

                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                                              Windows Command Shell

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1059.003

                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1016

                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                              $$a18AA.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a18AA.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 1c262693abc8a0dd07774deeeed3533744db365fa7124693426268a1f48c2e20
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a2636.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2636.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 0307084216db0757b589d8831388a2d045ed9dc2ed7bd85b85539c37747e9ee5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a347F.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a347F.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 77e74ddea272c29e7cd949a367552880e0c6804ca5cf85659b12685b56054f88
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a4121.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4121.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 fa9c20b8c94eadda853cd72fabc06f0b73a300212ad55e5559c02061bdf2acfa
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a57E5.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a57E5.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 ab2987c2a928a27f83145d7d2eddaf94be6c9ad81281134a3ee860d530d6d0a8
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a693B.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a693B.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 4b1993ece21d0a6568d236fcb5728efc1d0dbfed3667f1d242572b573b8d8f1e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a6D61.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6D61.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 5eab72203484af74f075608c1f9dabe574a56cef834efd124de49242d72d2301
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a7447.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7447.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 ff17260ae62318b4139837df1d1934d0c5fcf453b395dd62db6a4ca1c7553067
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a7C07.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7C07.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 fa99ef2cccd3a5ee5f26a89a7529a923c7603a76f9279daf75aff641937b6a00
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a82BE.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a82BE.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 98c4b599695e888e35515799b8ab97438f8cb8fdfcf48215ed45ff6a70818935
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a8984.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8984.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 8f87ee2ff9c66da35d1d10d2663f925adbbb58b29726323b42ccd41a1fd090b0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$a9116.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9116.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 e0285812c47a5701dfe62089e6d05b155d21a03f9a4ab6bcd434f6d73abd4295
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aC07.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC07.bat
                                                                                                                                                                                                                                                                              • Size 721B
                                                                                                                                                                                                                                                                              • SHA256 bf043a329b6381e5e023c54a45db3d3618fd1adcc4b94eed82388bfac53938d2
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aC22D.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 c53735ddbeb3aa9a04b8c7948af5ed651bc8b88291e8fbbdcb4f968320c93f14
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aC75D.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC75D.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 971a12840e941a7498c90899cd7d6b7a0ab946a99af0b398a27d34f18f7590ac
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aCDB6.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCDB6.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 3e14b52d734dfeaf8010aaa42bd87f07c2e913423b07a2843ec47fe86b28b60d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aD344.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aD344.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 875dc38de08d36dc3c9170ea417638cd85fbb4c8b7e0fbdb0b7ad210ef23e6a5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aDA2A.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 38285fc5f42408d94cc2597f933f0a5f00c295e93f555f5bb37af7613108f0ec
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aE601.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aE601.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 85308f97ea87d924fc60f672e251e23f5569c1a28bfb61bf31a6febcfe525f2d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aEFE4.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aEFE4.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 9fd5490c6eaf085da3e8998f4586b893929a176efcdeec3c7dc852b695af1002
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              $$aFE7B.bat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aFE7B.bat
                                                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                                                              • SHA256 68581178b18b21fd4f5de9bb726cfa70cf532b74f34ce956883d1fa3d1252aee
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 b40997d3eb0da50538e7194c9aacd57e12aeecaf4236ca28a19c1331f592916f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 4fb7021de4d52a6f147e58101e62c297ad52f045eb2c99ffea4687c241a86e87
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                                              • SHA256 6a39d897cfad4efa419fd84ee44f17874ea2b6d6e60666c7c6a1ef31e1a7a73a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 5f5087c87ce041e7f6ef80874857cfd10d175c80fd8d0ea76ae48a75f4e57aad
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                                              • SHA256 4dd7809186e511c3e0bf629f591a786c5cb3757fe22f51f7e3994b5ea3f0692d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 850aabcc7e59820e608bec08dcc2e0e12c798225eeeda47759e26fac01753049
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 ba038b57888fa8d516107b5453fc741f3837b1bb0e8b23bd250ce3e4099e38c9
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.8MB
                                                                                                                                                                                                                                                                              • SHA256 414b6c034b2083ed9dfe3620bbadbbdd640fa2887d91f0fc76880f4072e2d168
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 354b076e3f49a8b2287536aafa4cc0aebc19f3dc3c3d0de72a3da4198bef5cf4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.7MB
                                                                                                                                                                                                                                                                              • SHA256 5236250805757c68c1ab816ea35685357b65d027ff63550d30f40604ea3d2f34
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 b936103d4d502a42aea6654fbc6985618884ba14d4bcfca146f75fc88487becd
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 6.0MB
                                                                                                                                                                                                                                                                              • SHA256 5f81c0753416b5bbd2828b5a9843d2c820ff722fb4da0a9e5ef1b3082c709511
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                                                                                                                              • SHA256 bd1f7abfe657bba089b7e6a53030bdde3bb0923a2b8285d4eaeaa73d66219f33
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 ba242673b7fee92b61eecc0f8a8b2b2c58ca991444755654fc5ef45d937742ab
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 4cb0bcbe292d47c5a67591a8b29bb0611b7ebc2a66b07cf92bc655431102fc54
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 6.1MB
                                                                                                                                                                                                                                                                              • SHA256 e1926630bc5a3a9523f0c25cbb9dd26c8f3fb63e89efedc0d1c9d4b117b14be8
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 6.0MB
                                                                                                                                                                                                                                                                              • SHA256 d1ccb890669133ba6645ed6b2170fdcc96253c20d5422b9e6fd5e3c5dd65f778
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.6MB
                                                                                                                                                                                                                                                                              • SHA256 a0435949acc6172694bc18e5d645491f0f3070d9a77882d74870494386aa8657
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 6.0MB
                                                                                                                                                                                                                                                                              • SHA256 63cf803bc6f2c0db559ed7b5d33ecbcbcf4d4b7cf406716b5d97efbe86e3b158
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da.exe.exe
                                                                                                                                                                                                                                                                              • Size 5.5MB
                                                                                                                                                                                                                                                                              • SHA256 3928f45b689ccfd80d9d74882460b1fb98f2d702e5ea35fdeb71d51802454897
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Logo1_.exe
                                                                                                                                                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              _desktop.ini
                                                                                                                                                                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                                                                                                                                                                                              • Size 9B
                                                                                                                                                                                                                                                                              • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              memory/120-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/368-8639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/424-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/624-8052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/680-8748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/716-8441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/928-8850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/940-8107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1084-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1092-8646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1116-8162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1228-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1232-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1252-8682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1328-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1352-160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1384-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1412-8676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1420-8724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1424-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1472-8718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1544-6016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1548-8555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1576-2726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1604-8784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1612-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1628-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1648-8172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1656-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1744-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1832-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1840-8483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1928-8796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1984-8101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1992-8477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2004-8579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2036-1825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2112-8213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2116-8117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2124-8670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2188-8621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2212-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2232-8772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2304-8387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2368-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2372-8814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2424-8495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2464-8760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2560-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2608-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2676-8844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2692-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2724-8706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2744-8068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2804-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2864-8730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2888-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2900-8513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2940-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2940-2046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2940-8028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2940-1133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2940-7340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2964-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3012-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3020-8112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3060-8688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3172-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3272-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3272-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3280-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3348-8790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3372-8603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3444-8076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3448-8567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3476-8585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3544-8838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3568-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3588-52-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3592-8519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3656-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3696-8820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3744-8035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3764-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3824-8525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3864-8356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3888-8018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3912-8008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3928-8658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3972-8778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4084-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4116-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4120-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4132-8802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4148-8465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4172-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4200-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4224-8609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4268-8627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4280-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4296-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4300-8856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4348-8447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4356-8471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4360-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4380-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4400-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4412-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4416-8694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4436-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4500-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4576-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4600-8826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4624-8712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4636-8489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4648-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4656-8754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4672-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4708-8742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4712-8084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4732-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4776-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4796-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4820-8501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4836-8167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4856-8633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4896-5543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4924-8615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4952-8736-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4960-8652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4964-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5004-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5008-8543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5044-8147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5052-8459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5064-8507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5152-8531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5228-8862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5312-8832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5376-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5492-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5516-8043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5556-8060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5568-8026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5584-8766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5608-8808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5612-8597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5620-8132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5624-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5700-8561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5716-8700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5732-8537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5744-8320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5776-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5816-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5824-8122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5892-8591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5916-8549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5976-8664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5988-8573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                              Download