Overview

overview

7

Static

static

3

e46e4a10ee...40.exe

windows10-2004-x64

7

e46e4a10ee...40.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 10:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
  • Size 6.3MB
  • Sample260930-ml58bazfmb
  • SHA256 e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5124
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD145.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5288
      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2492
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD404.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3432
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD973.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4124
              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5576
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD6B.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2532
                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:6084
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE143.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4240
                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4884
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE635.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5220
                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3340
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED49.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5052
                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5000
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF383.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1992
                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:6040
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF95F.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4400
                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:6072
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4492
                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5716
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49A.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:624
                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:6124
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD4.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4280
                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4428
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10CF.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5064
                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3688
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a160F.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5904
                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1284
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AA2.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5728
                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4144
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F75.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2536
                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4212
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A81.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3348
                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5116
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a308C.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3808
                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4360
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3629.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:728
                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4324
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3965.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5896
                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3276
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D5D.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5860
                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4528
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4174.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4260
                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3532
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a424F.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1712
                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4796
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2900
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3392
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43E5.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:6128
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3316
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44C0.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:640
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1000
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45BA.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3388
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5644
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46E3.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1520
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5876
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47AE.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5900
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3280
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4888.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:692
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5800
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4963.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:2112
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5316
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A7C.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:1848
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:5624
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B28.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:5480
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5944
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C03.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:4780
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5484
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
                                                                                                                                                70⤵
                                                                                                                                                  PID:800
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4444
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D5B.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4156
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2240
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E16.bat
                                                                                                                                                          74⤵
                                                                                                                                                            PID:2128
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2828
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EA3.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:2888
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4080
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F5E.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:5936
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:3816
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50D5.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:4700
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:5416
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a520E.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:3720
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:2344
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52D9.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:664
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3960
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5375.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4472
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:5404
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5421.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4172
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:3540
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54DD.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                    PID:3420
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:536
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5589.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:5868
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:3904
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5634.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                              PID:920
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4544
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5700.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1440
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3792
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57AB.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:4440
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:3312
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B07.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                            PID:316
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:5796
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BC2.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:1852
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3104
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5836
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CFB.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:5244
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D78.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E04.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:3536
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:5284
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EA1.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                        PID:3932
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:5260
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F5C.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                              PID:4368
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FE9.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6102.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                        PID:1300
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:2800
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a618F.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:6036
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2140
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a621B.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:4152
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62B8.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                        PID:3500
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a640F.bat
                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4820
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4888
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6509.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                  PID:4148
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6642.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                          PID:3048
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66DE.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:2896
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                  PID:3476
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                      PID:844
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                          PID:4252
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6865.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:5596
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6930.bat
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4744
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5324
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69FB.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:4876
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                            PID:5448
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B82.bat
                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1844
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C7C.bat
                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E31.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4636
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1200
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EED.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3440
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FC7.bat
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7073.bat
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1744
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a714E.bat
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4208
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4612
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7219.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7630.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7814.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AE3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E2F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a812C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8284.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8320.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8543.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a867C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8728.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8795.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8812.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BFA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a904F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:32
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9215.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a933D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9570.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a962B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C94.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F82.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA04D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA34B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA426.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA58D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA687.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA742.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB099.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB200.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB491.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB52D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB81B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF6E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC00A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC394.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  356⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      357⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC47F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          358⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            359⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC53A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                360⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    361⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC605.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      362⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          363⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            364⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              365⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC76D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                366⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  367⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    368⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      369⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC886.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        370⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            371⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6056
                                                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                              PID:5088
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:4920

                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                Windows Command Shell

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1059.003

                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                $$a10CF.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a10CF.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 dedbcc5662bb2867b7f1f56549971700786f6f9f2baa0b0a1bba330e1db50bd9
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a16.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a16.bat
                                                                                                                                                                                                                                                                                                • Size 720B
                                                                                                                                                                                                                                                                                                • SHA256 57b931b999ff8168e0327798d0fad0457fc8be51a37643f8041df0d2c1a0b188
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a160F.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a160F.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 35d28251e6043f93184934686697808526a31e22bcd3b03d4b6dc17e8da983eb
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a1AA2.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1AA2.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 a57333d533c11e6a9f41fd864ec2e01b33c815ae1553a2055671cbc1338c61f2
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a1F75.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1F75.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 e97542858181746ce77515a63a10e531588519e75de1ddbb131d35a33f2b46b1
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a2A81.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2A81.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 a6ed2f6f85a32540a7646377b78d96bc1ae47e6ed5140739343960707063fb17
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a308C.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a308C.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 3de05c431a77ed9495c1d1a3488a3a9a1a9bf19aac6eed964929d4f3245ff8f8
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a3629.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3629.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 24a590ee6127b6cfe4f294dd8492474dad209c633c3d7893f590060548c1189e
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a3965.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3965.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 b06a11fd7f01ee19f92aba688ede4e4f58c97bc044104adc7de931bb5fd43072
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a3D5D.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3D5D.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 5e987aa316912c8ae2020aa8111bd80329fe660ebfe220e3db776a23d740847c
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$a49A.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a49A.bat
                                                                                                                                                                                                                                                                                                • Size 721B
                                                                                                                                                                                                                                                                                                • SHA256 ebbc2331586ca3d2d43e7692c3c259fa9e1bc141d3905689eab3f9f0c682ebea
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aAD4.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aAD4.bat
                                                                                                                                                                                                                                                                                                • Size 721B
                                                                                                                                                                                                                                                                                                • SHA256 3e46bc8c6dfe952dc7ceabaf686bc8cbe06fc94a9e400af25d3f02da3a69fc91
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aD145.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD145.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 9bfddbeb8cc978c4d29d46ca3cccfd14a10dcc4e07360854010dd50f695d53b4
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aD404.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD404.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 979f17338ab33d6664a30f510097558fb77463e0f138bfb0050ee9eb074ab831
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aD973.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD973.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 1f480f997546e383921973d06cfe263d0a6043a22708ea50bd5290d125831ecb
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aDD6B.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDD6B.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 e7ef01d9bb87d864445f1b8bdf941bb2f61d3d07b8b2f5a33456428a63b3c0f4
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aE143.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE143.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 21fe3ab597cb2d929ada459b5c0f5a4434a727fff2128ebc2c44d5d158b33571
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aE635.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE635.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 b9c9d76899466c7f40b3e3d654c5850f0d311213c09c068045dcc69f63b9e3fd
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aED49.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aED49.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 616d9a91b05ad75d8442e6097f45930a1031c43729d26ab4294062cd80d2fde4
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aF383.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF383.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 9216a8baf253f16efac8b451d96249b05bf4d2627451218dd238c1dc532447e8
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                $$aF95F.bat
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF95F.bat
                                                                                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                                                                                • SHA256 aaa7c3beade473b5843439e0a9753def613b8e96f5c74ed792042979f2f84d50
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.1MB
                                                                                                                                                                                                                                                                                                • SHA256 dad942968d5d4727d266c7bfcfc8128fb155e1f8294dee04980d8fb2f04193da
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.0MB
                                                                                                                                                                                                                                                                                                • SHA256 d1ccb890669133ba6645ed6b2170fdcc96253c20d5422b9e6fd5e3c5dd65f778
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.0MB
                                                                                                                                                                                                                                                                                                • SHA256 5f81c0753416b5bbd2828b5a9843d2c820ff722fb4da0a9e5ef1b3082c709511
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.0MB
                                                                                                                                                                                                                                                                                                • SHA256 63cf803bc6f2c0db559ed7b5d33ecbcbcf4d4b7cf406716b5d97efbe86e3b158
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.9MB
                                                                                                                                                                                                                                                                                                • SHA256 bd1f7abfe657bba089b7e6a53030bdde3bb0923a2b8285d4eaeaa73d66219f33
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.9MB
                                                                                                                                                                                                                                                                                                • SHA256 4dd7809186e511c3e0bf629f591a786c5cb3757fe22f51f7e3994b5ea3f0692d
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.9MB
                                                                                                                                                                                                                                                                                                • SHA256 6a39d897cfad4efa419fd84ee44f17874ea2b6d6e60666c7c6a1ef31e1a7a73a
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                                • SHA256 850aabcc7e59820e608bec08dcc2e0e12c798225eeeda47759e26fac01753049
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                                • SHA256 4fb7021de4d52a6f147e58101e62c297ad52f045eb2c99ffea4687c241a86e87
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                                • SHA256 414b6c034b2083ed9dfe3620bbadbbdd640fa2887d91f0fc76880f4072e2d168
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.3MB
                                                                                                                                                                                                                                                                                                • SHA256 fea3eab10ece2835b80a8294ca1421194d2951bd85c29a43a4af680e5688bad6
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.3MB
                                                                                                                                                                                                                                                                                                • SHA256 319ffa59874ac344b75d49bf2b06ef3212129499c22d36296b4858c8504a102d
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.2MB
                                                                                                                                                                                                                                                                                                • SHA256 dce5e54317e22efd862ccea507c69498f4590c21f5dd3b659f1b34bdd7e13447
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.8MB
                                                                                                                                                                                                                                                                                                • SHA256 b40997d3eb0da50538e7194c9aacd57e12aeecaf4236ca28a19c1331f592916f
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                                • SHA256 5f5087c87ce041e7f6ef80874857cfd10d175c80fd8d0ea76ae48a75f4e57aad
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 5.7MB
                                                                                                                                                                                                                                                                                                • SHA256 5236250805757c68c1ab816ea35685357b65d027ff63550d30f40604ea3d2f34
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.2MB
                                                                                                                                                                                                                                                                                                • SHA256 f3bd80ab5a1255d6b64ef26fe616c10414e2a78d2685c055e2d1f52c6472bbab
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.2MB
                                                                                                                                                                                                                                                                                                • SHA256 fa02c5e006151e34d9027b68271f6250d1fd0c8c2489bcacb8378eb51326e641
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.1MB
                                                                                                                                                                                                                                                                                                • SHA256 b87fa4a1725466af7ab5238b5dd6a67f0e2c3c216aa89222eb8d91009225332e
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\e46e4a10eef11bc9954cab6b2a44cbd92e0b93fbc8978c83f6662efe18c61c40.exe.exe
                                                                                                                                                                                                                                                                                                • Size 6.1MB
                                                                                                                                                                                                                                                                                                • SHA256 e1926630bc5a3a9523f0c25cbb9dd26c8f3fb63e89efedc0d1c9d4b117b14be8
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-681733028-2344970462-962213935-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                                                                                                • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                memory/32-10692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/176-10768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/536-10357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/652-10657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/756-10813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/884-10702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1000-10280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1020-10828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1056-10622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1072-10793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1148-10738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1164-10873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1172-10582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1200-10487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1208-10577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1284-6127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1288-10617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1292-10753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1644-10522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1688-10547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1704-10436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1744-10502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1780-10592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1804-10572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/1880-10868-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2008-10723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2040-10607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2072-10687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2080-10733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2092-10512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2136-10602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2140-10417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2216-10677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2240-10321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2300-10426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2316-10763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2320-10471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2332-10712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2340-10632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2344-10341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2424-10758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2492-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2492-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2540-10567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2608-10409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2628-10823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2664-10456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2720-10788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2800-10413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2828-10325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2832-10848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2844-10441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2948-10542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/2956-10405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3180-10476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3276-10255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3280-10293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3312-10373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3316-10276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3340-1249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3356-10537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3392-10272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3404-10818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3432-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3476-10446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3532-10264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3540-10353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3568-10707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3640-10612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3688-5988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3692-10773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3732-10637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3744-10878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3792-10369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3804-10843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3816-10333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3832-10863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3848-10552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3872-10778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3904-10361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3960-10345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/3976-10798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4080-10329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4140-1219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4140-2347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4140-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4140-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4140-10281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4144-6238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4152-10421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4200-10743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4212-8864-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4216-10833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4220-10718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4252-10451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4324-10248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4360-10241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4380-10393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4420-10597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4428-5612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4444-10317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4456-10652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4480-10662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4528-10260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4544-10365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4572-10858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4592-10697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4612-10507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4644-10492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4704-10627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4760-10532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4788-10497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4796-10268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4808-10783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4876-10466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4884-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4888-10431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4956-10587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/4968-10527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5000-1879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5116-9944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5124-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5124-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5244-10389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5260-10401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5284-10397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5292-10803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5316-10301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5324-10461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5332-10667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5384-10642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5392-10517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5404-10349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5408-10838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5412-10647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5416-10337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5484-10313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5576-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5600-10482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5608-10381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5624-10305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5644-10285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5656-10682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5716-3735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5768-10672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5784-10557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5796-10377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5800-10297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5816-10562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5836-10385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5848-10748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5876-10289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5944-10309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/5992-10728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6008-10853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6040-2367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6052-10808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6072-3195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6084-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                memory/6124-4872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                Download