Overview

overview

7

Static

static

3

917bcd402c...dc.exe

windows10-2004-x64

7

917bcd402c...dc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 16:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
  • Size 6.0MB
  • Sample260930-t244hsys5q
  • SHA256 917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1452
      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2460
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2457.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3712
          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4724
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29B6.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4580
              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:988
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1432
                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2528
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DDA.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5668
                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3840
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1296
                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1636
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5819.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3056
                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2212
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CAD.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2020
                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:1900
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6066.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1876
                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1924
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63F0.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:2532
                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1792
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a675B.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5056
                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2636
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A88.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5284
                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3532
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4136
                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3940
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a712F.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1604
                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:616
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a742C.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1480
                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3440
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1344
                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5488
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2820
                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3720
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E3E.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4508
                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3412
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a815B.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:6124
                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4760
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8478.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4528
                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4124
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88DD.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2672
                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3300
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A25.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1784
                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4288
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B5E.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2508
                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4420
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CE4.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1592
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5880
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E7B.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:6132
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4324
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FD2.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:6060
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4952
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4688
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2032
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930F.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2764
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:6088
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94E3.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2828
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:6068
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a962B.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:1896
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:864
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9793.bat
                                                                                                                              62⤵
                                                                                                                                PID:2736
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3968
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a990A.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:4452
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:292
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A71.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:5412
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:5452
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C17.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:4940
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1552
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D8E.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2576
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:5296
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:2640
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4412
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA01E.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:1472
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4988
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA128.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:4180
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5860
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA251.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:4964
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:2136
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA389.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5940
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:1224
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA474.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:2912
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2720
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:4632
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:3612
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6F4.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1240
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:1292
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA83C.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                    PID:3156
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:4856
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA965.bat
                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:1548
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:428
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA7F.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1112
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB79.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                  PID:5700
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:1492
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC82.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                        PID:5256
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:2880
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD9B.bat
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                              PID:3028
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE86.bat
                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:1396
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:3900
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF70.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:3204
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB07A.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:5516
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:2616
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB183.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:464
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:3244
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2DB.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:5476
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3E5.bat
                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4DF.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4792
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4312
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:5784
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:3460
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB721.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:1044
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3696
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:1740
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3108
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB925.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                              PID:1140
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:4084
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB57.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:1848
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2100
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9F.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                PID:5652
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                    PID:2840
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD99.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:1180
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:572
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE93.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:2184
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF6E.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:2968
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:4644
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC058.bat
                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:5252
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC162.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:4512
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:6076
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC23D.bat
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                      PID:3092
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:4820
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4212
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC440.bat
                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                PID:5044
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2928
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4108
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC644.bat
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:2252
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5948
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC838.bat
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:2520
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:3164
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA3C.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:3504
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:688
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB16.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5468
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBE1.bat
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:5588
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD87.bat
                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD018.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD18F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD279.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD363.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD43E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD519.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD603.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD98D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE092.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE13E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE49A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE574.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE63F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE797.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE853.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE92D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA95.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF080.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF236.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF468.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF524.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF69B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF737.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF979.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA06.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAA2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBFA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a253.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a408.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a560.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a699.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a735.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a977.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF82.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a101E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3004
                                                                                                                                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                PID:5884
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                      PID:1252
                                                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:3500
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:3160
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:1760

                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                          $$a1E6B.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a1E6B.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 3cd1d58593eb4e54ed26bb8bf57022d8df4e95104c3bd850f6dc43b95c8e769c
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a2457.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2457.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 bb4c0d8649913708d53bb1ed1d9ca609ad42553aa6e2f1f5e20e98b79369d5d6
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a29B6.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a29B6.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 f928160ba4a89bdf2b84ad669abae4cd9b680a8fc29e9fc4cc8d570213abedef
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a309B.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a309B.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 a6dd46e21664d3e468f27741ce9d24d9336435f91660896fcfef3b3fa7a3d63a
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a3DDA.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3DDA.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 59c3f91f3b7cfa7c9e907be8d9308fd902e0305c670f9bfad21ac243a6f88031
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a42CC.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 0a4b95b47365680c3e5a1afd781bf256778b049d49ac87ca1be3a5d3432222c9
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a5819.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5819.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 6077aa2955d8f004118f6b95d2868a18d053d8eb9cf9055d88db90e655edeb8e
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a5CAD.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5CAD.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 0325fa8e98789464c64f6f3785c590afe8d1075e8c9737c9c28599876c7a49d3
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a6066.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6066.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 2efe8d6c2d34ea115ec52e8f2e6636de8fef106bf02588eac4eac17c7bd32353
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a63F0.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a63F0.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 cc94e0aca7ff2444ca9b96599f664d1586d53f6d1e2474c98cc3ebbd6e195236
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a675B.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a675B.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 17a531ae0747dc19c755a367b94f06ae1c09e131fb8a3906aab4adc5f059ce2b
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a6A88.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6A88.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 719114de757cff34e8d1014420523377a5559b727a847bd334f9f65f4da1cf0a
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a6DA4.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 74d32cd7db30cea3c4e4d7d259bb7d6849d5a9bb052fb9860cd35bcdf009239c
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a712F.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a712F.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 3a64391775e11d0b2c62f2d105873ab31e96b16ff22407d2d97c84455b88605a
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a742C.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a742C.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 f9b6e0db03ecffaea803382c83de89ff6806c3f20d8f038700366e1ed4227881
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a7749.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 9fcf9ec1acdd35061381152dab5e201ac814e004736925eaa5f8e92b753f963e
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a7AF3.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 6ab897dd2c0caefdf6325df2f5e3498eecd9e542e607778bf4d1bc204d4c0869
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a7E3E.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7E3E.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 14eceeb125a11b39fb4fb59b0bf47940cc820d84326ebc5032661c5f324aca6c
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a815B.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a815B.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 0398aced555a27c8082c95b5503a20dbd07beef1ebf45342e5ef6991b3758e29
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a8478.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a8478.bat
                                                                                                                                                                                                                                                                                          • Size 722B
                                                                                                                                                                                                                                                                                          • SHA256 868e90c1594cd3867246eaa241438afaf2743c397ebb6ab61cf76984cbb7b2e2
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 6.0MB
                                                                                                                                                                                                                                                                                          • SHA256 7977b69bbfd80853ba9e527b90ab67a7c8398766fb71c9063cea570fbf8b134d
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.9MB
                                                                                                                                                                                                                                                                                          • SHA256 953aa02139797f47cbee7b938f9d4c257d7e91b4ed9b81e72a384bab129fb70f
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.9MB
                                                                                                                                                                                                                                                                                          • SHA256 468de5765ec2b521fb60a5722aa148af8717b114bd2b602fa6629d92f1418682
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.8MB
                                                                                                                                                                                                                                                                                          • SHA256 e864416028bce4b793d38fc328cea8aa0b96cefe9520463d6b24a8cd06ff0818
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                                                          • SHA256 aed4616734f26909b151cd74c6636fbb58e89f7a8d5a667a35a629ed8ab344da
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                                                          • SHA256 4d76555ae8009d92e8cbfe552020c6bdb730e35bc0d568fb334562507affa010
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                                                          • SHA256 893886a5813d80a7cbe31b1abe6269a362eb17e169424268d43e564ae292fb53
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.9MB
                                                                                                                                                                                                                                                                                          • SHA256 abb094bfe2eaba5ff813dd495b927668d77923c7f3e6e86ef34ba908910a06e7
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                                                          • SHA256 a51e808fa435e5bb8fd73dec53321c12d1641c2b1500d014e2aeab79fbc3a847
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                                                          • SHA256 96fb28817c3995bbfaa6d65f2281312b33a9a2cd21c15a8e6d298436234b1353
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.9MB
                                                                                                                                                                                                                                                                                          • SHA256 5937695cba79bf1c5c5dd621a8c01d2116b7afad24471205c758423d09fe6948
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                          • SHA256 282f6ce90551b8a61205037d263f323095b289bf4bd112dc9713bf3556ef0561
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.8MB
                                                                                                                                                                                                                                                                                          • SHA256 b75e5076a0737adb19544c457f517a9b0c081576c7b2a2fa7efb7c19604140b7
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.8MB
                                                                                                                                                                                                                                                                                          • SHA256 35ff8abf2787542778423d448293acd82c4adccca1362bb5a7e8dba04433de2a
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                                                          • SHA256 08dcc411b108c6e69a8a39f33f17b3f26b3a57ad993bf8165627f978b24e03b3
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                                                          • SHA256 566c861e8414aa58485b1410691756256a71bef5971f95f2e2291ec701e931d9
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                                                          • SHA256 10949f78dd0c2da453a2b598aefa917ebe17be17cec1d7289e2f808e90705d6f
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                                                          • SHA256 8985dd9235a2c50f769ae944484a05574e549ec8e2afa18996e6d027ad42a5bc
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                          • SHA256 a13e587282c31e0adacb26b249909f17b66c9734e6b5e62d62ce22f5f194f070
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\917bcd402c7bc88c396686c620ba9c84fb6dc79b2f20c5ddc4678389f7a171dc.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                          • SHA256 290c302deb710ea929562875cc2de2dd471b479a9837fe6c550b3af5b8e9ee96
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          Logo1_.exe
                                                                                                                                                                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          _desktop.ini
                                                                                                                                                                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-1704430598-3087477806-3297458608-1000\_desktop.ini
                                                                                                                                                                                                                                                                                          • Size 9B
                                                                                                                                                                                                                                                                                          • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          memory/8-6083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/292-5718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/296-6221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/428-5783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/572-5883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/616-5607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/688-5961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/864-5708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/876-6215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/976-6374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/988-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1124-5860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1212-6053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1224-5758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1292-5773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1372-6173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1400-6275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1492-5795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1552-5728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1564-6326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1568-6263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1608-6113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1612-6197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1616-6392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1636-5535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1644-6047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1716-6071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1724-5889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1792-5575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1804-6368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1900-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1924-5567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2032-5693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2084-6293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2100-5871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2136-5753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2212-5551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2216-6380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2240-6017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2252-5937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2300-6245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2460-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2484-6356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2528-1357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2572-6143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2604-5901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2616-5820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2636-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2712-6320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2712-6314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2720-5763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2840-5877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2880-5800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2928-5925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2940-6269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2956-6155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3008-6185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3024-5973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3088-6035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3092-5913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3108-5855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3164-5955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3184-6281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3232-6239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3244-5825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3300-5662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3328-6077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3352-5985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3412-5640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3440-5615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3460-5845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3492-6227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3500-1503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3500-5538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3500-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3500-2159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3532-5591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3564-6386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3612-5768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3640-6089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3660-6287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3696-5850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3720-5632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3760-5991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3776-6149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3840-1825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3844-6311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3900-5810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3940-5599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3968-5713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4084-5865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4088-6065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4108-5931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4124-5657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4132-5979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4204-6191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4212-5919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4220-6398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4248-6179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4268-6233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4280-6161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4288-5667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4292-6299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4312-5840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4316-6029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4320-6338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4324-5683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4396-6344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4412-5738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4416-6003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4420-5672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4500-5835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4524-5997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4532-6203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4620-5815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4644-5895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4668-6125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4672-6119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4700-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4700-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4716-5790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4724-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4740-5805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4760-5650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4776-6362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4832-6101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4856-5778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4880-6251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4884-6023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4900-6059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4932-6131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4952-5688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4988-5743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5240-6350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5268-6107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5296-5733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5324-6167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5452-5723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5460-6137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5464-6009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5468-5967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5476-5830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5488-5678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5488-5623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5576-6257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5636-5949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5656-6305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5860-5748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5880-5677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5884-5644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5884-5784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5884-5627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5888-6095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5944-6209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5948-5943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/6068-5703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/6076-5907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/6080-6041-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/6088-5698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/6096-6332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download