Overview

overview

7

Static

static

3

9a83afb6f7...e1.exe

windows10-2004-x64

7

9a83afb6f7...e1.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 15:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
  • Size 3.7MB
  • Sample260930-szsr2aybpf
  • SHA256 9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BBE.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F77.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1228
          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2960
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81A9.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2304
              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1668
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84B7.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4728
                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1564
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a866C.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3796
                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5284
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8851.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1304
                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:2516
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A83.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5072
                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1312
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4708
                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:860
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E4C.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3984
                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:5044
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9030.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:916
                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5656
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5352
                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:432
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B2D.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4932
                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4468
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4316
                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1396
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1332
                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2440
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA251.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:720
                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4524
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA406.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1300
                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5452
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5BC.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:8
                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2588
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA791.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2512
                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5716
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA975.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:6072
                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2824
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB0B.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4304
                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3928
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABE6.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4400
                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3268
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC92.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4608
                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2796
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1872
                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4976
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE47.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2868
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4432
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF03.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5760
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1672
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFAF.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5628
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4628
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB099.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5564
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:6128
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB155.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5924
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4624
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB24F.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2080
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:2732
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2FA.bat
                                                                                                                          60⤵
                                                                                                                            PID:3252
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:5616
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B6.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:6036
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1964
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB471.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2576
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:2864
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB50E.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:1540
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3932
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5C9.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:5132
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4812
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B4.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:708
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:3108
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB75F.bat
                                                                                                                                                          72⤵
                                                                                                                                                            PID:2212
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                              73⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3840
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7FC.bat
                                                                                                                                                                74⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:1524
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4880
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1464
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2744
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:424
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:3588
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA0F.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:4876
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4972
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBABB.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:3248
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:4840
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB76.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:696
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:1240
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC32.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                              PID:4656
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCED.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3988
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:4724
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE35.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4416
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:2932
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3044
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:5348
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC087.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                            PID:4264
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC143.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:1892
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:1132
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC20E.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:3288
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2F8.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:5556
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3A4.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:5000
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:5388
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC450.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC50B.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:1688
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5C7.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:3948
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC682.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:2016
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4600
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC70F.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:5412
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7CB.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:4312
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4480
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8A5.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:3196
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:5764
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC932.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:5772
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:5128
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9FD.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:6048
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA99.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                            PID:3224
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                PID:2852
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB55.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                    PID:2536
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBF1.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:5792
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:3944
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF5.bat
                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                            PID:1236
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEA1.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:4592
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF3D.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:2604
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFF8.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0A4.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1344
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD150.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:992
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3272
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1DD.bat
                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:952
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:1128
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD279.bat
                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:3800
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:4780
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD306.bat
                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3704
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:5740
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3D1.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:5584
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD48C.bat
                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3096
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:5096
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD528.bat
                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:4692
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3980
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5B5.bat
                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4392
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD651.bat
                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5104
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD71C.bat
                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD893.bat
                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD93F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC0E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCBA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE054.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE100.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE19C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE267.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE371.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE40D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE48A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE517.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE594.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE630.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE749.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE99B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB31.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2992
                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                          28⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:2768
                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                            29⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:2272
                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                              30⤵
                                                                                                                                                                PID:2712
                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                        C:\Windows\Logo1_.exe
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Enumerates connected drives
                                                                                                        • Drops file in Program Files directory
                                                                                                        • Drops file in Windows directory
                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4732
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                          3⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3584
                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                            4⤵
                                                                                                              PID:6128
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 840
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            PID:2580
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 992
                                                                                                            3⤵
                                                                                                            • Program crash
                                                                                                            PID:4684
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4732 -ip 4732
                                                                                                        1⤵
                                                                                                          PID:5016
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4732 -ip 4732
                                                                                                          1⤵
                                                                                                            PID:5556

                                                                                                          Network

                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                $$a7BBE.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7BBE.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 c58b6fd376ba7283f8818676b036cbcb24bc41b22aa591c1bc6eac228d70a543
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a7F77.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7F77.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 185205835c5b28d56c4b446fac30c370c106a45fa1a16d0108f75f19d3029bac
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a81A9.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a81A9.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 3d922489bc3d2e0c9507adab197ee7abcc429807172ccfed6b289ddf5bbbdc1f
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a84B7.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a84B7.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 e14dbfc8eedf6d060e630995914071715f69f7bebd52dad5ccfa0dc42ef52e2e
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a866C.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a866C.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 e9ea52927f9b831961b692271b57866143a0004f4fecbf45652c60a706a3a6a8
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a8851.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8851.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 277fa36931ba695c8b8112ae8e48066e9b275eb7a6917b7ae1dea962de37bf10
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a8A83.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8A83.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 1f3945d6fa4c47e20adf4f6e84b556e33628abd031d0392470cc367d1b89b8ad
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a8C39.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 5597062240309b74bd736620ec80cba9aa4b8e5dd88c104b06705f6019a0b8ef
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a8E4C.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8E4C.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 e0f01259d86223797e9cba9437738f4790328206907f0d5b7c4253b96c518566
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a9030.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9030.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 0e2c79fe39fef3edbd24da9e4dc8d20ae95ff5e43a7d4b63fbfaaa71f55f0e13
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a98EB.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a98EB.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 534cdaa6cb30775d074a084df8341aef30ddab0e8e3cd656590845b74191470f
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a9B2D.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9B2D.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 a23525a69e3e9c56c324528b2fa902789062c530c1c65f62ab97bf63910d6094
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a9D7E.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 9cd908822f4c41048e4a00a2e4edbda1b9f0af6f8d9845c4acd64a47fcad3dcf
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA0CA.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 7bb7b1324bba009d2660c1f9c2dd03c8a08b46a4d9d0e1a54dbbdaa4d1e4296f
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA251.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA251.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 166610c6fe884e7bb6840ba0ce199d98d817b8abc33ba342b6efb919c32c1a5f
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA406.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA406.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 2ad1390a7591c0c62ec77a4a535c3de7faec4dc6cadc2c45244ebf8f0510f392
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA5BC.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA5BC.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 400e101cb4226a25fab637e46bf0880a7d005c5125ba9654e188a83978a1a8b9
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA791.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA791.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 aa4adb552efc414a95329d1de8e4bd51327c7f6fde66bfae256fc769cf1d03db
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.3MB
                                                                                                                • SHA256 8e1e482b5c6511296915cfc7e906672db3e8940027f80b6026f3d4133fac56f7
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.3MB
                                                                                                                • SHA256 1703827a7ec7e7f603e11bd1e7a76a86632bb28c63f31abc80e0255bcdc1ce6f
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.7MB
                                                                                                                • SHA256 8aa94b2111505d9ed8ee170069a1ad40e55a7c84798fe9df56afae5ed05335bf
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.6MB
                                                                                                                • SHA256 08dd6e9f28b8e667aa9220ce117ec86f473b5212c17570f250421fc7cad576b5
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.6MB
                                                                                                                • SHA256 45cd28f414acb6ffc3972753709465d31cdb19c4d1137ad6f8f9054959eb7b78
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.6MB
                                                                                                                • SHA256 0a96f27b449a726bae136a9e8bc7a96971e0e87d2f780fa3545e58f6b2719394
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.1MB
                                                                                                                • SHA256 e26b985be5051a588018469bc749cb92bc5e5b156e82c1ebb4676fb2a56050a1
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.2MB
                                                                                                                • SHA256 d8f35ae7bbffde079b9155a4285e0bc96adb98b972f024c143ca9fea3da230cd
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.5MB
                                                                                                                • SHA256 d72251b9e2b734cb870c1367bf89950904ad377c20df5dff6a8dd3cfb31db11a
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.5MB
                                                                                                                • SHA256 519d98381438fbb3d54c9fe377e482e21556c0616ca61261868b9d76eae48333
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.2MB
                                                                                                                • SHA256 986de4103ee0ba9369eb878dd3e398d2de8dc426f3a74ab15c35a91c1058f72d
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.5MB
                                                                                                                • SHA256 72290c3e67df3fef7baf7fe91305ab71a65f964c700489779f55764381edacf6
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.4MB
                                                                                                                • SHA256 d338bfd9a850fb33046022a1f19f2c800ee0d2fa63430fab390c1b7dd07c1d9e
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.4MB
                                                                                                                • SHA256 9ecba38354964b7a20153d7e00f3c8f8382a0a7fb4ce33dd5aaffe213a268762
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.4MB
                                                                                                                • SHA256 bb8928e5ed46d74e16dbbf15e8e414d05f7c38d6c0c6ce863d343980af649dd0
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.3MB
                                                                                                                • SHA256 cc39c95b9c5e18c15de6e612b9b0401e2cccf38b13c1b759481122edfb2e070b
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.2MB
                                                                                                                • SHA256 b253c2f63802f739de2f3b3f2bc75374540d7eb49ec612165ae510ce384e96cf
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1.exe.exe
                                                                                                                • Size 3.2MB
                                                                                                                • SHA256 c7c3468fe24a494b7c14bc28724e5c8c27232d5af29b979124466f127e15ffde
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                Dll.dll
                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                • Size 68KB
                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                Logo1_.exe
                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                • Size 32KB
                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                _desktop.ini
                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                                                                                                • Size 9B
                                                                                                                • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                memory/432-1361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/860-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/904-1872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1128-1726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1132-1593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1208-1655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1236-1690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1240-1553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1312-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1344-1714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1348-1938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1396-1387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1408-1708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1516-1568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1564-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1624-1702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1668-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1672-1468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1964-1498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2332-1902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2408-1884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2440-1395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2460-1618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2516-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2572-1914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2588-1424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2732-1488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2744-1533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2768-1453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2768-1634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2784-1774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2796-1452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2824-1437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2852-1660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2864-1503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2960-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3024-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3028-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3044-1578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3108-1518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3232-1840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3268-1447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3272-1720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3316-1926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3456-1932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3576-1860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3588-1538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3640-1962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3648-1768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3840-1523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3916-1896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3928-1442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3932-1508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3944-1684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3948-1623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3972-1822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3980-1756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3988-1563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4116-1798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4152-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4152-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4172-1858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4240-1852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4248-1786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4260-1956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4276-1588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4372-1666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4392-1762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4416-1573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4432-1463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4468-1370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4480-1639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4508-1846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4524-1403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4560-1816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4592-1696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4596-1792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4600-1628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4624-1483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4628-1473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4676-1908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4732-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4732-1364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4732-641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4764-1672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4780-1732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4788-1804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4792-1598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4796-1890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4812-1513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4828-1944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4840-1548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4856-1834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4880-1528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4888-1603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4928-1878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4972-1543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4976-1458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5044-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5044-1419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5096-1750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5128-1650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5188-1780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5284-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5348-1583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5388-1608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5412-1633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5452-1413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5520-1828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5584-1744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5604-1950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5616-1493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5656-1353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5716-1432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5728-1810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5740-1738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5764-1645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5792-1678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5828-1920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5836-1613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5868-1558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6128-1478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download