Overview

overview

7

Static

static

3

aecfe7da93...11.exe

windows10-2004-x64

7

aecfe7da93...11.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 11:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
  • Size 6.3MB
  • Sample260930-npgvkatfpg
  • SHA256 aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCC3.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4688
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF73.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4088
          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2076
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC54F.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1840
              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4480
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8D9.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1100
                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4516
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1F.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3700
                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:208
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0F7.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4548
                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:396
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4308
                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3996
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE26C.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5112
                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4024
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE896.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1320
                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4188
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE53.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3052
                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:560
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1DD.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2024
                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2880
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5F4.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2364
                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2340
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9AD.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5104
                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3204
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDD3.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1204
                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3236
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19C.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4700
                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:640
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a526.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4540
                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:884
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4724
                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4976
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1061.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4008
                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4828
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19C8.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2796
                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2300
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a239B.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:448
                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2908
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2503.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3492
                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1396
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25BE.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1944
                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4156
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2689.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2032
                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1064
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2764.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:100
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5012
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a286E.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:644
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2916
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a290A.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2324
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4432
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29C5.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1828
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1384
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AA0.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4412
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:552
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BB9.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1720
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5004
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CA4.bat
                                                                                                                          60⤵
                                                                                                                            PID:3696
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:3232
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D6F.bat
                                                                                                                                62⤵
                                                                                                                                  PID:4344
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4824
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                                                                                                                      64⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:540
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:3676
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E69.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:1460
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:3868
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ED6.bat
                                                                                                                                                68⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2516
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4400
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F53.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:3260
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1152
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FC1.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:3508
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:2684
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a302E.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:1408
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:2856
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30AB.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:1984
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5076
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3109.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:2080
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4120
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3176.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                  PID:4800
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:2536
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31D4.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                        PID:1804
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:2268
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3241.bat
                                                                                                                                                                                            84⤵
                                                                                                                                                                                              PID:2360
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                85⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32AF.bat
                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:4332
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a331C.bat
                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                          PID:3268
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4300
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3389.bat
                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:3628
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3336
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33F7.bat
                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:5000
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3464.bat
                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                          PID:3924
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4068
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34C2.bat
                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4984
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:1872
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a352F.bat
                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35AC.bat
                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:4020
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a360A.bat
                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                PID:1428
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3677.bat
                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                      PID:1920
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:3444
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36F4.bat
                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:3780
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:656
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3762.bat
                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                PID:2188
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:2752
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37DF.bat
                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:548
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a384C.bat
                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                          PID:5040
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:632
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38C9.bat
                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                PID:4316
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:2540
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3937.bat
                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:3220
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:2824
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39B4.bat
                                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                                          PID:4168
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A40.bat
                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3032
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ABD.bat
                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:2164
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:3976
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B4A.bat
                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                              PID:1248
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:3312
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BA8.bat
                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:2644
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                    PID:2940
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C15.bat
                                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                                            PID:4656
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C82.bat
                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:3900
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CE0.bat
                                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:1680
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                            PID:556
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DAB.bat
                                                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:3108
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E28.bat
                                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E86.bat
                                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2876
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F03.bat
                                                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1456
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4672
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F70.bat
                                                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:64
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FDE.bat
                                                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a404B.bat
                                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1692
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40B8.bat
                                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4126.bat
                                                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4193.bat
                                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4201.bat
                                                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a426E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:368
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4329.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4397.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:688
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4404.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:736
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4472.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a452D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a459A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4666.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a483A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4915.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4973.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ABB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a502A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5097.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5104.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a526C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5356.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5450.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a553A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5598.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5615.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5683.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5700.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5809.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5942.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FAA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6095.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6383.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a643E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6519.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a698E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D37.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F6A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7015.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a711F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7238.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7574.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a765F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7759.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a797C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      356⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          357⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              358⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                359⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  360⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      361⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C5A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        362⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            363⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              364⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  365⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    366⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      367⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          368⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              369⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  370⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      371⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5280
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                      PID:1060
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                                        19⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                        PID:4260
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:4176

                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                            $$a1061.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1061.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 c54fb9b159acbc2667138eca0a16e457248d7edf53bead6ad7dda55b108512c8
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$a19C.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a19C.bat
                                                                                                                                                                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                                                                                                                                                                            • SHA256 a170c101d04aab22ee7dcffd8c6f825735f2d8aa777c6df01579de7dad53ba5c
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$a526.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a526.bat
                                                                                                                                                                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                                                                                                                                                                            • SHA256 77b1aef57fbb0e294c50ec12b02265bf0b5785db5e2b9f8e7b86d1b5d81bcffe
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aAB4.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAB4.bat
                                                                                                                                                                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                                                                                                                                                                            • SHA256 f40ba471756fd2f9f49bf656a89c64c48116f9fb7e655ddeede99e9620dbbf5e
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aBCC3.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBCC3.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 48fdf845f3f88237fe6b6637a5f8ab2f331d3f84cfc3a95c9640ef97f3937f9e
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aBF73.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBF73.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 a17fca6f06e800d6f884b063091a35eecc3f4761d0368161517c4e27082f8af6
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aC54F.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC54F.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 be68de56cdfa6e457ede31d434f2dba8d32c1b53b4ba26461c610c544115fd08
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aC8D9.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC8D9.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 8d2aeee9e10b8238ad1cdd6a09573271991d75b5c5ae4e3c1458cd4a41c3c99a
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aCD1F.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCD1F.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 9933d119c08066573bc6c1baf1645605ec3f1e0f55b4c652104c1697b0258abd
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aD0F7.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aD0F7.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 d7c2dbff6c8c5b040f5d0fef6893750aa69ff38c68afcc94352f814b13ff6d2f
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aDD2C.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 57c5e1eb94b06c4d6830e984f85d80b3c90a49a55753814665a60d9e20492aea
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aE26C.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE26C.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 01789ec8375275ec1ee65ebb2267b40c1e90400edac8033ce0e3b9b118927792
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aE896.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE896.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 25494e4e58be82c81cdefd5bcaeed124abf1dcfc511fb85a2a00c6d31b944494
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aEE53.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aEE53.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 a5876d46541f27b07d53683dd5f2375b90cf0cd22761ec7d44bfe979c0b3498f
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aF1DD.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF1DD.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 51a878163e559ba52aa9e74335bbce6d5e09f54068d1796644b64d121798e2aa
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aF5F4.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF5F4.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 92ac3c465c8d2496af667e4064a83a147a045fe64eed3c0e628855dbe78d621c
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aF9AD.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF9AD.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 8d4e113e1ac10c024a0ce32f00b47f92b6df380b4518cd7c3ba1a44798246861
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            $$aFDD3.bat
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFDD3.bat
                                                                                                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                                                                                                            • SHA256 c1fd6c6cb4cc56139e91f48704bc8d128f153af85f00c0f1bb2acae41b976cf7
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.0MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 df3cb96c35e5eeaf2c2b1757fe8986df1b85615178991d7b99a94cd268b17f5b
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 5.9MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 357259ac18759d88a9bb796958bac5462af82ad3970bb12d9b0afcc2b093b564
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 5.9MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 e4b6cef0c572b292815dfb016cdff894ab9bac0a715d0cdc594d43893bcc9238
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 5.8MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 33a895f9e5bcfa20ee1d4061d9f8a1aa019c4bd912c7e317797a495ffc69e862
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 5.8MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 39197e9aa0caefa7fbc352cc2155a391c6fe9643af11c5b5e6069589804c7832
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 5f01bbf2e49e29adcdd55b0464fb9e9638416d96042112d9d7a492347a5fb335
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 d50ebd83c5b34d46fe03ad764c991f7cca030272e13bc9c1dbccdd00744667d7
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 918e6450bf6502fcbb2d9bfd985eaab779de4d7f4a83631544fc56236c7ab733
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 2e9b5837f131c31054cc04a34f9d73391713fd461fe124a0c8d9b66420e238cb
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.2MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 a085edf6e776894b4f82c28e9df421f3d34006227d24aa8ab2ca73b532b6e6a1
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.0MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 cf02b4b759602adae79ab0d8f99a5d0db4f859042d7cc01ab464b7987a2012f6
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.2MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 e8e543ea1bfaa665c5ca675612e6f69e0bb4baf0c913b3b37d2f8b6caedef02b
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.2MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 4d7231ea5e78954d6cbf104ac32bb10deb2e24a231634b2c8776c27a6a38e27f
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.0MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 c833a6405297babd601b13c4ec15fa50dd8da648d8384ab66dcdb06a9d254f1d
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 8dcf562c611a520ba675a6a40272442ec259a4c9e388e0feb1b0c4c8f37b04c2
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 5.9MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 3c94e22bb7a4cef06eb34371b3325446e4cf4f7b7c6b1b95b70a01765ab02b93
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 5.9MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 cb7ab0d79e593e288b4a6289808f74e3968b9be48d075e3516235336226b0a2a
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\aecfe7da935bdee5b74d69eb8b9d9d5b21d0ad7cd7c195800b2132b44ad13e11.exe.exe
                                                                                                                                                                                                                                                                                                                                            • Size 5.8MB
                                                                                                                                                                                                                                                                                                                                            • SHA256 611f98bee56a7cb128d4712101a965d983530426b433b63efa61be6d96e8c6a8
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            Dll.dll
                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                                                                            • Size 68KB
                                                                                                                                                                                                                                                                                                                                            • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-1846164713-4096795028-774071693-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                                                                                                                                                                            • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                                                                            memory/208-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/368-2814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/396-1578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/400-3044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/464-3069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/548-2694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/552-2585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/560-2487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/568-3019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/632-2698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/640-2523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/656-2686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/736-2829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/884-2530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/928-2809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/976-2804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1060-2512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1060-2678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1060-2534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1060-2465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1064-2565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1080-2749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1144-2884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1152-2613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1156-3029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1212-2819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1220-2739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1248-2934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1384-2581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1396-2557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1420-2824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1464-2789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1476-2954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1492-2969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1536-3064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1544-3120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1636-3009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1644-2984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1668-2641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1680-2744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1688-3150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1780-3155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1872-2665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1960-2774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/1980-2754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2036-3135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2076-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2088-2794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2168-2904-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2220-2894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2228-2669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2236-3074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2268-2637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2300-2549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2340-2501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2396-2944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2496-2959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2508-2854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2536-2633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2540-2702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2596-2974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2684-2617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2736-2874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2752-2690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2800-2859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2824-2706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2852-3004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2856-2621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2876-2764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2880-2494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2908-2553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2916-2573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/2940-2729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3032-2714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3184-2677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3204-2508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3208-2899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3232-2593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3236-2516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3272-2879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3288-2759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3312-2724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3316-2844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3336-2653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3392-2924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3424-3085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3444-2682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3452-2994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3532-2799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3604-2949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3620-3014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3648-3125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3656-2999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3676-2601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3684-3100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3708-3079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3716-3105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3760-2919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3772-3039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3808-2869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3824-3034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3852-2834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3868-2605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3976-2719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/3996-1987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4016-2914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4020-2673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4024-2467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4032-2784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4036-3160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4040-3059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4068-2661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4108-2710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4120-2629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4152-3145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4156-2561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4188-2478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4200-2909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4224-3140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4260-2451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4260-939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4260-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4260-2454-0x0000000076E90000-0x0000000076EA9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4268-2939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4300-2649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4332-2645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4376-2849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4400-2609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4404-3130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4432-2577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4452-3024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4476-2964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4480-44-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4508-2929-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4516-55-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4564-3049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4572-2889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4584-3095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4604-2839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4616-3110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4656-2734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4672-2769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4688-17-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4688-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4728-2989-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4768-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4768-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4772-2779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4824-2597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4828-2545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4844-3054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4932-3115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4936-3090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4972-2979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/4976-2538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/5000-2657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/5004-2589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/5012-2569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/5076-2625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                            memory/5084-2864-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                                            Download