Overview

overview

7

Static

static

3

0fff71c838...3a.exe

windows10-2004-x64

7

0fff71c838...3a.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/10/2026, 08:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
  • Size 5.3MB
  • Sample261002-kt955aed48
  • SHA256 0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9E0.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD4.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3852
          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3516
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE059.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2080
              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1660
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE375.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3116
                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3704
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6D1.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1392
                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4260
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA4B.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2064
                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4792
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE62.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4500
                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4340
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4CB.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2044
                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1520
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7F7.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:4656
                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2344
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAD6.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3960
                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5024
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9F.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4336
                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2020
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a342.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3772
                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4648
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AD.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4996
                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3012
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1904
                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:976
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA6.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2516
                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2308
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10EE.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4240
                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3976
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14D6.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2748
                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:708
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1786.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3744
                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:432
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AC2.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4992
                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1384
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E5C.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:936
                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2628
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EF8.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4176
                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1188
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2021.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:932
                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4100
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a213A.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2240
                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3164
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2224.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:720
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3844
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22FF.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3696
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3672
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a239B.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3876
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5036
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2447.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1716
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2544
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24D4.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:404
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3948
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2570.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1616
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2888
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25ED.bat
                                                                                                                          60⤵
                                                                                                                            PID:4528
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1884
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2689.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:1340
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:4300
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2706.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:4316
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:3816
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2793.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:1972
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:228
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a283F.bat
                                                                                                                                                68⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4776
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5076
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28EB.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3252
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3508
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2977.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:2640
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2276
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A23.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:516
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4640
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AB0.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4400
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:2572
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B3C.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:3400
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:3484
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BD9.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:3628
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:4760
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C85.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:4356
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:804
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D11.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1016
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:4984
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D9E.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:2436
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:2428
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E4A.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                  PID:2008
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EC7.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:3092
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:2384
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F44.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:1080
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:4236
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FD0.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:2372
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a304D.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:4924
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30DA.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:4328
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3157.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                PID:4692
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:456
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31E4.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1012
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3270.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                            PID:2808
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32ED.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                  PID:2416
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3389.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                        PID:3452
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:2208
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3406.bat
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                              PID:3288
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:512
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34A3.bat
                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:2480
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35BC.bat
                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                        PID:4904
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3932
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3649.bat
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3656
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:680
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3704.bat
                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37EE.bat
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a387B.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1324
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:1100
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3946.bat
                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:4012
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39C3.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:4224
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:4944
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A40.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                        PID:1516
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ABD.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:792
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B3A.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                  PID:5004
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:2684
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BB7.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:372
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:1136
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C73.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                              PID:1056
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                  PID:2764
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D0F.bat
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:4732
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DAB.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                            PID:3964
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:2964
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E67.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:3984
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4036
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F80.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:4072
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a403B.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:1856
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4164.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2884
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:4872
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4210.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:4444
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1624
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2364
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4724
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4368.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:3328
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2740
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43F5.bat
                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4552
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4472.bat
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:3788
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a452D.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a459A.bat
                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4627.bat
                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a482B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4982.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50A7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5143.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a528B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:60
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5327.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5421.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a555A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5634.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a573E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5867.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5903.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FBA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6066.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6102.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a616F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6298.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6325.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6392.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a641F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6567.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6671.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6855.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a696E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A0B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F0C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7025.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a715E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7229.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7332.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4596
                                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:2692
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                            PID:1764
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                    PID:540
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:1756

                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                        $$a10EE.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a10EE.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 390237b162fc305c0b2bb90499d4ea469fb6c77c7d772a0849c2f93351397a08
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a14D6.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a14D6.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 c6554f9378fc83b963545012a70784bc8646a8275c842b14edf3d8564bb54934
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a1786.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1786.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 9065518294bbb579e2ec1c191222467aa7ca111b8ef2ad459ea5ddaca9c91186
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a342.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a342.bat
                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                        • SHA256 3738e00bc181acc624ed4f82753753247f0c7058f919a44cbec398aecb0e57d4
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a6AD.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6AD.bat
                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                        • SHA256 a9e9aa7aafbbb1cffc573c5a5daa93fd0ab18e341cd0733b2499a47e1143ce44
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a8C0.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8C0.bat
                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                        • SHA256 ebfa2d8650deef70f403b57a0e58965eabcd324167e7951e4f763b24f0a28f82
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aD9E0.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aD9E0.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 0a809467992540adb78629e2e88f114fce19cb5eb511ca495dada36abdfa2e76
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aDBD4.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aDBD4.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 b8451bba0a26e5afe17dbc56a564b007d1ae93f8386d0777f11900c4e86f1e01
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aE059.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE059.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 12d44fb4fd1ae11bb948fae23d407438ddba1cd117802108c407f99a1a657cac
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aE375.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE375.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 978ca28855840ab9d2f70b48d1082fb4e316fe7c139a753db158db227467f13c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aE6D1.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE6D1.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 ed829f1887be78ee03b14e4055c64e4da3816c32670471711edefbb34ec1b483
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aEA4B.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aEA4B.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 f006ee5ce17370387734b02003e518bcf0ad6da72fc2fec72d3e0e5c9ae5e653
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aEE62.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aEE62.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 df7e0a4cc1e9b2453d3a461e9153dc992dd9743a6af05ee2b26914a3fc761ac8
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aF4CB.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF4CB.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 e9587c865b85ce472da06294977b07a121c87a48c74d54b03f55e6a8a4b85409
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aF7F7.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF7F7.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 7b90c8fc974a4fb1bd4aa52e5cdb7f3d2f2162c8545198c7507f5b759512ffe4
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aFA6.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aFA6.bat
                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                        • SHA256 9ab8edeb095d1fdfa96c4084120bb7ed9277ec9103d31f6699c5c46a45778736
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aFAD6.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aFAD6.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 441414a5ebadd28d8433b63ba6045b8a9c8e984ee3c3896e7c7c93e252ce2dd4
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$aFE9F.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aFE9F.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 1e955ee80ea4a1ebc5a3fbb0f314d9249fa8a51ed1a939858485ef559d3751c0
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                        • SHA256 09c4c101f790dc995ae79fd1d30bfe67cc2a42cf63acd80158a8e6144c72c18b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                        • SHA256 f420b37ea37b68f380901a1dd3d7f5810ac0680692f4ced3f13eb4835c89decd
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                        • SHA256 de86b9ae62c47479652657d3be11ab53fd86220cb9d8599c5af8be8a3492df55
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                        • SHA256 dabc2453ea3815753fa4fe0726ea2c3aa633aaab9ed2a464f62d3ff9f1b42c92
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                        • SHA256 7bfe469eb93932bfac3df868d068d7e6e25715db6e6a3deff6af8b9ad62ceeaf
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                        • SHA256 d3f92c71738bffe186cf608aa91108d20205e6dd62d2a09f2e755d17c9829b22
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                        • SHA256 f95ff48137ca6b2c82f2438500138fa59877713473a424af8e1c7228f7efea35
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                                                                        • SHA256 30b2a774c3f7585d76a3dbcc985e6461da7ac481dfb8c9d4485276bb07b8e611
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                        • SHA256 a009955eadf905741102d45edf0245250a1ea6669bd08fbc76e0e732d7d27ad7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                        • SHA256 4553a65fcc8559f2876eb7c129b620cc140b7cf9daa6da6ec43c5ce4400fa29c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                        • SHA256 dc655c38b005825d3eadadc2b4e0536db57e53ca029ba6761deafba5c7748836
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                        • SHA256 8221cd5e4cf9e66f0d2e8783dc68b8874d045741bed0823c2e94c00dbb9d94e8
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                        • SHA256 ba2b21fff8a63ccc3e0c482b18f0b0a4b1f3fb2e28176216dfcdea4ce2043b42
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                        • SHA256 e1340ec0ac56d316ee7f3d3d9814a9747623ed7f62848137040353127a4d69d9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                        • SHA256 dff2403977d7272fbbccbdc45af3dfd16e12045345bf54590de2a56a7341100b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                        • SHA256 e2074539e3a6bed8fca74e2f3d1ad2648ea9c47177acaf8eb1caca2482c50bae
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                        • SHA256 a721450db2a72d5c312938091bb76ca63d85a8f3a6597b20c93dc3956cd665b1
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                        • SHA256 fc723e8865bd150fa5f6fe42744449412f11514255e414a850014755312a2ebc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Dll.dll
                                                                                                                                                                                                                        • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                        • Size 68KB
                                                                                                                                                                                                                        • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                        • Size 9B
                                                                                                                                                                                                                        • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        memory/216-823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/228-510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/368-859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/432-434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/456-596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/512-621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/540-326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/540-382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/540-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/540-358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/556-991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/680-637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/708-426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/724-1015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/740-1051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/804-551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/976-397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1000-781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1012-601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1100-652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1104-751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1132-757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1136-685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1160-841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1188-449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1380-1069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1384-439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1452-955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1456-901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1464-853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1476-1141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1516-667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1520-338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1536-1087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1624-733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1660-46-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1756-1063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1880-1117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1884-495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2020-363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2116-1099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2208-616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2268-877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2276-526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2288-715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2304-642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2308-405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2344-346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2384-571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2412-883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2428-561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2480-626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2496-895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2504-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2544-480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2572-536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2628-444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2656-1111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2684-679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2692-461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2692-393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2692-633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2732-829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2740-745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2764-691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2800-1135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2864-973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2876-865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2888-490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2932-769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2964-703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2968-1123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3012-379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3084-787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3148-1075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3164-459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3180-919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3196-978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3232-1081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3276-775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3312-1165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3332-591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3364-647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3428-1105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3432-1039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3448-1189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3484-541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3508-521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3516-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3536-871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3552-763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3600-931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3604-997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3672-470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3704-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3748-805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3816-505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3844-465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3896-1093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3932-631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3944-985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3948-485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3952-566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3976-415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4036-709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4100-454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4108-943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4132-967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4144-889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4152-586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4160-1183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4216-1171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4232-657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4236-576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4248-913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4260-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4280-961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4284-937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4300-500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4312-1129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4340-330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4392-1057-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4408-1159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4420-949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4432-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4432-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4436-907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4448-1153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4452-581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4556-1027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4572-1147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4588-1177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4600-1009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4636-611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4640-531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4648-371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4664-799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4724-739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4732-697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4756-606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4760-546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4792-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4796-925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4868-673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4872-727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4880-811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4912-847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4920-1003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4936-835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4944-662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4948-721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4984-556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5012-817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5024-354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5036-475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5048-1033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5056-1045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5060-1021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5076-516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5116-793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download