Overview

overview

7

Static

static

3

7214700176...70.exe

windows10-2004-x64

7

7214700176...70.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 11:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
  • Size 6.0MB
  • Sample260930-nryabsec56
  • SHA256 72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a919C.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:540
      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a942D.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4504
          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2264
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a994D.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1060
              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3248
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DF1.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3112
                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4148
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA227.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1044
                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4812
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA65D.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3732
                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:4540
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE9A.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3132
                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2276
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5BE.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4656
                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1660
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAFE.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4768
                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:1752
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC484.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5112
                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3884
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC917.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:2636
                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:8504
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6D3.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:8544
                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:8736
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9D1.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:8764
                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:8852
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE087.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:8908
                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:8972
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE114.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:9000
                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:9068
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE49E.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:9096
                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:9156
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE857.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:9184
                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:9260
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBB3.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:9288
                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:9364
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF9B.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:9392
                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:9452
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF344.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:9476
                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:9536
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43E.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:9568
                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:9616
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF529.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:9644
                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:9704
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5A6.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:9728
                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:9788
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF652.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:9816
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:9856
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF70D.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:9892
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:9952
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7F7.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:9980
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:10032
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8A3.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:10060
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:10112
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF940.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:10136
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:10192
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9CC.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:10220
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:8332
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA3A.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:8296
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:8188
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAE5.bat
                                                                                                                              62⤵
                                                                                                                                PID:8132
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:8036
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB91.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:8004
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:7964
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC4D.bat
                                                                                                                                          66⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:7928
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:7860
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD76.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:7848
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:7800
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE41.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:7772
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:7720
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEBE.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:7696
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:7644
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF3B.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:7620
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:7564
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFD7.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:7516
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:7488
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                          PID:7464
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:7412
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:7396
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:7336
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17D.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:7308
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:7256
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a248.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:7240
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:7176
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a352.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                                PID:7144
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:7096
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:7068
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:6988
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E8.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                            PID:6964
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:6884
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a594.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:6856
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:6808
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68E.bat
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                      PID:6776
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:6728
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a749.bat
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                            PID:6700
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:6648
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D6.bat
                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                  PID:6620
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:6556
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a863.bat
                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:6564
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:6488
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                            PID:6460
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:6404
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AB.bat
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:6376
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:6328
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA47.bat
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                      PID:6304
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:6256
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC4.bat
                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                            PID:6232
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:6176
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51.bat
                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:6148
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:6096
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0C.bat
                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:6032
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD35.bat
                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:5988
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5936
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7D.bat
                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                PID:5912
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:5860
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67.bat
                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                      PID:5832
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:5784
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1004.bat
                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:5704
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10FE.bat
                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                PID:5676
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:212
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a117B.bat
                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:5636
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:5556
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1227.bat
                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:5524
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                            PID:5480
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1311.bat
                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                  PID:5384
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13DC.bat
                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                        PID:5256
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14D6.bat
                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:5292
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:5164
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1582.bat
                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:5184
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                  PID:5132
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a165D.bat
                                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2756
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17A5.bat
                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                            PID:4484
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:4648
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1870.bat
                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:3088
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2576
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a191C.bat
                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3780
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19A8.bat
                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                                PID:416
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2672
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A54.bat
                                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:396
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AF1.bat
                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4652
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4204
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B6E.bat
                                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:3932
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C39.bat
                                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CB6.bat
                                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D81.bat
                                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:384
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:8144
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8088
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8348
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8436
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a207E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8456
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2178.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8484
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8532
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8592
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a235D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8700
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8644
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8780
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8856
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2560.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a262C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2783.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a285E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2939.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A71.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B6B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E88.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a305D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3176.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3212.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3464.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a354F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3677.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3723.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C44.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F22.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a454C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4666.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4702.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a479E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a480B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a502A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5162.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a520E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a529B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5346.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5460.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5663.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a574E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5886.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5980.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7740
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                            PID:8556
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                              PID:8632
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                  PID:8708
                                                                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                    PID:2220
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 736
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:3872
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 1540
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:5304

                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                        $$a919C.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a919C.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 42e73459f3579fc5d5dc4c594e25beaadf5351a30b1aa14375d1966d81a1af33
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a942D.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a942D.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 4ab47b404d57cb0ff47fd3afc56d33a27826bdcb751beebd4fbad5a249661c98
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a994D.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a994D.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 2fe8a2f841e067b195052f2cc45a608ac7b337a0953e83f3ab5b55fee25d6dc1
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$a9DF1.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9DF1.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 ec9f20bc06344f8c8c84eb075e6c6ffc953f4314fab272fdf365af80f8109c7c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aA227.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA227.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 18941966f63441cfd7a3f7f367352e629f5295a3edc9d131fa4fd13c16a22485
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aA65D.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA65D.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 4b58013e6ab1ae4cfb1ec56bcc2086728569696fcbe7f01256bf435b3ec8af75
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aAE9A.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aAE9A.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 db18acba6b103a6b1eda057b4d3014be3445efdd843e118fc93fa56860b9c765
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aB5BE.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aB5BE.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 f4103a1e779311f9eb144729b22d30698d6e464b3c714394fbdffd2d18e31716
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aBAFE.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aBAFE.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 014a2823b6e7b2de1c71478b1fcf459e684a77a94fb6663c3d94913dcacefff1
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aC484.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aC484.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 5db751db09ea36eee052afd434ef1dc84eeb416f1dab7512fa6ca85d2b255ff7
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aC917.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aC917.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 c3e640da2631efef5611612bbec62207b809f9bd677350a5ffe99fd34a864e42
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aD6D3.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aD6D3.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 323c382ad9147feaeb5aa253e9f746eb26ec293d6b70c8a40fa880a3834d2788
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aD9D1.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aD9D1.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 a3560b59e8aeae85094a5286cb3040917f0d5681bde7f880367b9c0584fbded1
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aE087.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE087.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 13edf787003ab30bb21d4e7c3fe6a24b9e9017909163b474d1a7253a3d99d471
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aE114.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE114.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 83db18f7128dd710007f21d2ab124fa16a21c8d9ba28fc6316cf3b856b180d3a
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aE49E.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE49E.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 365a3dbb130e92b0ec1c863bc07908413cbb3347039c5adcd3931730fc9c46db
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aE857.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE857.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 9edd3e1927fa3eef1e2a485c86164bc2cee75da489052366d70d420b369aded2
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        $$aEBB3.bat
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aEBB3.bat
                                                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                                                        • SHA256 9e8ea1c98d99cc126811bebea2b70f0286ff2fa78c096bd82b9925fb6ef82fb5
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                        • SHA256 e5f0688ceb01db130704b6d7add9fcc2a97ed8f35f91047ab6b18026d0ff007d
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                        • SHA256 27d21bc13a1f966158b90a9dd7eb7b6bea2f8033d8caf48c4948fc4cf855d84b
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                                        • SHA256 62078f9338dae09e417a53528d90c0a46f2c6b32eaf52f54b9ad043a2184f201
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                                        • SHA256 cf0f4baaca5bba5c89d2155acf227a475a1bc6c3e4e187df5cc9d9ab6409b04e
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                                        • SHA256 5b20b99526910eb8d287c83ad0210acdb6f733138a7bed7765288530049787c4
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                        • SHA256 0419577cabb7883161448e4405ce4289f9707424c3cb644bb4746dff5fb7cfa0
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                        • SHA256 be4994fe5bc3439a5e8c5fc3d954149fee6c11d9a7910e173480206df56e5196
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                        • SHA256 59aa6c304061ce481ba6093547cac49aa223bed925b9f94cdaf0c51127bc57c8
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                                        • SHA256 6f7d05c78128c9cfbfa2f118738e867dacfe918b9865c3ab12eb0a8e8a469ad5
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                        • SHA256 68605395b8c0a9ac06d52794ff28b3a0da2108d0f4442f5a00ddaa71726900bd
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                        • SHA256 265c7b3f22c75cfdc06e7b56f8a06c8e98916fc9a50986a6532dfc639a280c0d
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                                        • SHA256 87ec2ca4fc283e71c7e7561002312dac3bb5d36d487c68409d63d84fbc652bf9
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                                        • SHA256 679f5ccc60b125e0a18b98fc4e1a96daaf6f6c38ffb3b0fa1104ba6294fe0d64
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                                                        • SHA256 fcc520b1270a4ae71ec3b477ec81383b0153dc191688f205e7d0e4f622ba59ec
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                                        • SHA256 abce9a37cf266d6b8b3cf620eed30f6e712df34a810bf274a7a3a396f8b79b7f
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                                        • SHA256 9ac6d0ba5b0ed1ff1cf9fa49672050678c1e4d173d0bd2e3b142175f52ba191b
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                                        • SHA256 cf19ab74eb4fd4fe8f4adb49ee1c802f7e7aba7e7840bd2393acb071b2bcb132
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\72147001769f84c4467c285fec98638fbdedf6a235ec6fae94165237148b7a70.exe.exe
                                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                                        • SHA256 10b1c3a48f635300fdcb9c51545cefa41e1fa3b7e4679ad4fdc45d79d078173f
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        Dll.dll
                                                                                                                                                                                                                                                                                        • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                        • Size 68KB
                                                                                                                                                                                                                                                                                        • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-524788801-3318743092-4051225893-1000\_desktop.ini
                                                                                                                                                                                                                                                                                        • Size 9B
                                                                                                                                                                                                                                                                                        • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                        memory/212-5753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/384-5837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/396-5812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/856-6155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/856-6160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1076-6148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1540-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1540-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1540-1738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1540-5513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1660-1842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1716-5832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1752-2563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1756-6018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/1796-6133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2192-6098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2264-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2276-1692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2548-6143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2572-6190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2576-5797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/2672-5807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3248-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3828-6180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3884-2732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/3932-5822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4148-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4188-6185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4204-5817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4232-5857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4348-5827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4404-6175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4436-6165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4472-6138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4496-5802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4540-859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4648-5792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4812-63-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4864-5862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4884-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4884-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/4944-5787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5048-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5116-6170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5132-5782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5144-6128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5164-5777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5208-6123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5256-5772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5280-6118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5384-5767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5396-6113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5480-5762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5512-6108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5556-5757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5604-6103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5704-5749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5716-6093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5748-6088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5784-5745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5844-6083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5860-5741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/5936-5737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6032-5733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6040-6078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6096-5729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6116-6073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6176-5725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6184-6068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6212-6063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6216-6058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6256-5721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6328-5717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6388-6053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6404-5713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6488-5709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6556-5705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6584-6048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6648-5701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6680-6043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6728-5697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6748-6033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6808-5693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6844-6028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6884-5689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6912-6038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6984-6023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/6988-5685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7096-5681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7132-6013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7176-5677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7220-6008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7256-5673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7316-6003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7336-5669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7412-5665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7488-5661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7524-5998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7564-5657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7580-5993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7644-5653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7668-5988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7720-5649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7724-5983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7756-5978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7800-5645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7852-5973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7860-5640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/7964-5636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8036-5632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8116-5968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8120-6195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8144-5842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8188-5628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8232-5963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8276-5958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8332-5624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8348-5847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8364-6200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8436-5852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8504-5526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8556-5641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8556-5523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8556-5584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8592-5867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8700-5872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8732-6153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8736-5533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8780-5877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8852-5544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8856-5883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8972-5551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/8984-5888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9068-5558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9080-5893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9156-5565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9168-5898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9260-5572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9272-5903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9364-5579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9388-5908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9452-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9492-5913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9504-5918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9536-5588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9608-5923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9616-5592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9668-5928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9704-5596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9776-5933-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9788-5600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9856-5604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9952-5608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/9972-5938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/10032-5612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/10040-5943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/10112-5616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/10120-5948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/10184-5953-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                        memory/10192-5620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                        Download