Overview

overview

7

Static

static

3

0fff71c838...3a.exe

windows10-2004-x64

7

0fff71c838...3a.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 08:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
  • Size 5.3MB
  • Sample261002-kt955aed48
  • SHA256 0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B6E.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20FB.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2144
          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1828
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2292.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1272
              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:2992
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a260C.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1832
                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5740
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a291A.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:240
                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1660
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CA4.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5604
                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1116
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F53.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3260
                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1988
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34E1.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4964
                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1984
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E96.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:4804
                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5944
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FFD.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5644
                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:6116
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a520E.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3284
                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:6096
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53F2.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4760
                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1152
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a571F.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5616
                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3564
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B55.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1136
                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2440
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E62.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2896
                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1396
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6121.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3124
                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1392
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a641F.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2604
                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2444
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66CE.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:356
                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2476
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a695F.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5320
                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4980
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C1E.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3788
                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3840
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DB4.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4112
                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3100
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EDD.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5792
                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5728
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FD7.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1172
                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4724
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70E1.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1160
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4200
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7219.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1072
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1652
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7342.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3000
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2740
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a744C.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4892
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5836
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4300
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1088
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a766E.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4120
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:3448
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7778.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:5404
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:3376
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78A1.bat
                                                                                                                              62⤵
                                                                                                                                PID:4348
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4188
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79BA.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:2424
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5656
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AB4.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:4952
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5460
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BBE.bat
                                                                                                                                                68⤵
                                                                                                                                                  PID:5096
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                    69⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1212
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CC7.bat
                                                                                                                                                      70⤵
                                                                                                                                                        PID:2596
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                          71⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2984
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DE1.bat
                                                                                                                                                            72⤵
                                                                                                                                                              PID:5720
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                73⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5784
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EDB.bat
                                                                                                                                                                  74⤵
                                                                                                                                                                    PID:6072
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                      75⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4276
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FD5.bat
                                                                                                                                                                        76⤵
                                                                                                                                                                          PID:2656
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                            77⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:1528
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80DE.bat
                                                                                                                                                                              78⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:6088
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                79⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:4384
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C9.bat
                                                                                                                                                                                  80⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:2812
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1628
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82F2.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                        PID:4888
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:6092
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83FB.bat
                                                                                                                                                                                            84⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5488
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:3008
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8524.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3928
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:3568
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a862E.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:620
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8737.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                            PID:2804
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2732
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8822.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                  PID:832
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:4492
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88FC.bat
                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:5636
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:704
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                            PID:4604
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:988
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B3F.bat
                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                  PID:1124
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:1836
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C58.bat
                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5480
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:4236
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D61.bat
                                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                                            PID:1768
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:5472
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E6B.bat
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1076
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:4588
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F55.bat
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:1408
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a906F.bat
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2252
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:3464
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91A7.bat
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:1412
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92C0.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:2724
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F9.bat
                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:4876
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94E3.bat
                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1524
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95CE.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                PID:3296
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96A8.bat
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:5244
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97A2.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                          PID:4936
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98BC.bat
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                PID:4012
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99A6.bat
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                      PID:5628
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                          PID:2456
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A71.bat
                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                              PID:2552
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:3120
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C27.bat
                                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:2224
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                                            PID:5128
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
                                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                                                PID:3444
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                    PID:5764
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DFB.bat
                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:4596
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FEF.bat
                                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5800
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3248
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA109.bat
                                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:2356
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5468
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1E3.bat
                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3128
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:5592
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2CE.bat
                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:2652
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA399.bat
                                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2908
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:1468
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA56E.bat
                                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2312
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:1816
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA668.bat
                                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:920
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA742.bat
                                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:3460
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA83C.bat
                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:680
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB099.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB397.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB491.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB52D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:96
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB76F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB82B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB973.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC152.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC29A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC337.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC46F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC51B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC663.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC79C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC838.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC6E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD008.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD150.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD344.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD557.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD73C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD874.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD901.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2484
                                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                              PID:2640
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                  PID:4580
                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:4364
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                    PID:2856
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:940
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1132
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4364 -ip 4364
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1176

                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                        $$a1B6E.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1B6E.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 61d0244cc64b2de0062e687940e25503b48984cb0f373ec42d211f5a7681ec41
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a20FB.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a20FB.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 407d8f8c5ac3cd1bed02ad2ef34bef562105e6d343a384cb1a6749a3d689cd42
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a2292.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2292.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 e71a08daf76827fa6fcf0e646e31d146a02a29b04400597ee7f5c85ee3f290b2
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a260C.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a260C.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 050156dad4553369113f098a7258305ece1e2c9e735a38288cd447aefa2ebf68
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a291A.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a291A.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 dc230cf14a294415fd62cfd60c1936ebed06f563e0d7aa3939c6afc58fa445e4
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a2CA4.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2CA4.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 4524e21ac6a6de003c3a5b5beead7f58bffa691a1b6fa731bcfccff8b33e978c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a2F53.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2F53.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 0fffc568bf8289856a77efed97ff88e1e5d6b7e821364d348517458117738076
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a34E1.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a34E1.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 3a54c55c971282246d194874a8e19065c29e7d259f00633c5842b714256589e9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a3E96.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3E96.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 7ba24c049e8d2dfbfc922c62dbc2a27a4eacce5693658479a759b33267b5523b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a3FFD.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3FFD.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 d9a26e1afa9195a17f397c546c7189fb82751176e410200b10235997bc815561
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a520E.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a520E.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 c3a51f321970400c9ba84cb70254c75f6e2fa13171d58cb0e9cf835d15a44ae1
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a53F2.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a53F2.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 7b79c14422cbe6781bc083bf4e38699bb5474fe256f0817bc00a7c68bad55ee7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a571F.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a571F.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 fbf311eb970173e27f0dd7979aa67ae1b3d08fb1cb0df4e51ff23d606e0f1377
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a5B55.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5B55.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 cf4c89aff8efdf889eec604a33e382be30f5a006577c7397dde2992e517a1eae
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a5E62.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5E62.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 09368c4f8f4c41c26dd738a52a661c092028637778c1e18abdecfe8b8188163c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a6121.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6121.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 b8f9afd0799cc64165c72396fdb05728d68fc2aa58c14484980fbf8aeef12035
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a641F.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a641F.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 3cce90cfbd8da242dce3bc82f52d07b94615dcd4e2f0afd8b5b98f77decd6315
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a66CE.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a66CE.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 991b5d63dbe74969a43fbf4031fdc723ff29aa165241b0345c0dc8320fcc072b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        $$a695F.bat
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a695F.bat
                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                        • SHA256 dd4573f26aec67fc1fb702ec97d26e5a6a5e7fb81c3c17ffb1ece65f35ca8784
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                        • SHA256 a721450db2a72d5c312938091bb76ca63d85a8f3a6597b20c93dc3956cd665b1
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                        • SHA256 dabc2453ea3815753fa4fe0726ea2c3aa633aaab9ed2a464f62d3ff9f1b42c92
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                        • SHA256 fc723e8865bd150fa5f6fe42744449412f11514255e414a850014755312a2ebc
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                        • SHA256 f95ff48137ca6b2c82f2438500138fa59877713473a424af8e1c7228f7efea35
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                        • SHA256 de86b9ae62c47479652657d3be11ab53fd86220cb9d8599c5af8be8a3492df55
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                        • SHA256 a009955eadf905741102d45edf0245250a1ea6669bd08fbc76e0e732d7d27ad7
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                        • SHA256 8221cd5e4cf9e66f0d2e8783dc68b8874d045741bed0823c2e94c00dbb9d94e8
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                        • SHA256 e1340ec0ac56d316ee7f3d3d9814a9747623ed7f62848137040353127a4d69d9
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                        • SHA256 09c4c101f790dc995ae79fd1d30bfe67cc2a42cf63acd80158a8e6144c72c18b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.8MB
                                                                                                                                                                                                                        • SHA256 dc655c38b005825d3eadadc2b4e0536db57e53ca029ba6761deafba5c7748836
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                        • SHA256 4553a65fcc8559f2876eb7c129b620cc140b7cf9daa6da6ec43c5ce4400fa29c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                        • SHA256 ba2b21fff8a63ccc3e0c482b18f0b0a4b1f3fb2e28176216dfcdea4ce2043b42
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                        • SHA256 7bfe469eb93932bfac3df868d068d7e6e25715db6e6a3deff6af8b9ad62ceeaf
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                        • SHA256 dff2403977d7272fbbccbdc45af3dfd16e12045345bf54590de2a56a7341100b
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                        • SHA256 d3f92c71738bffe186cf608aa91108d20205e6dd62d2a09f2e755d17c9829b22
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 4.7MB
                                                                                                                                                                                                                        • SHA256 30b2a774c3f7585d76a3dbcc985e6461da7ac481dfb8c9d4485276bb07b8e611
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                        • SHA256 f420b37ea37b68f380901a1dd3d7f5810ac0680692f4ced3f13eb4835c89decd
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\0fff71c838561151a0e083fc8a1d3441c3cfa0d789ef13c80a92ae8ec09bdb3a.exe.exe
                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                        • SHA256 e2074539e3a6bed8fca74e2f3d1ad2648ea9c47177acaf8eb1caca2482c50bae
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                                                                                        • Size 9B
                                                                                                                                                                                                                        • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                        memory/124-5751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/200-5534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/556-5576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/560-5492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/604-5765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/620-5152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/680-5421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/704-5171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/764-5527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/836-5878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/988-5177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1088-5056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1116-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1152-4925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1156-5464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1212-5092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1216-5499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1236-5779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1240-5478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1388-5857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1392-4973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1396-4961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1420-5709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1468-5351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1528-5116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1560-5758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1628-5128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1652-5038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1660-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1664-5207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1708-26-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1752-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1800-5667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1816-5358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1828-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1836-5183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1880-5372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1936-5407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1984-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/1988-1555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2012-5520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2040-5379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2076-5485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2132-5639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2160-5744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2272-5730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2380-5772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2404-5604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2440-4943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2444-4982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2456-5267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2476-4993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2532-5625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2712-5864-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2724-5225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2732-5158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2740-5044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2788-5688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2840-5653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2860-5255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2876-5618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2956-5429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2976-5548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2984-5098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2992-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/2992-2327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3008-5140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3048-5695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3088-5723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3100-5013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3120-5281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3144-5885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3176-5660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3204-5829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3248-5316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3340-5414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3376-5068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3404-5836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3428-5569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3448-5062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3464-5213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3528-5309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3564-4934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3568-5146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3764-5681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3832-5231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3840-5007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3880-5302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3900-5871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/3948-5400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4000-5506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4104-5632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4108-5611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4140-5237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4188-5074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4200-5031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4208-5457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4220-5243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4236-5189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4276-5110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4364-4945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4364-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4364-2319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4364-1846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4384-5122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4392-5443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4420-5737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4432-5807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4452-5513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4468-5450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4492-5165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4588-5201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4592-5344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4608-5471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4672-5814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4712-5674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4724-5025-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4728-5843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4736-5822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4740-5033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4740-4959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4780-5562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4824-5219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4860-5793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4868-5555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4980-5001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/4992-5274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5032-5261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5116-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5116-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5124-5716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5128-5288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5152-5646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5192-5702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5244-5249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5312-5597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5428-5436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5432-5393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5460-5086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5468-5323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5472-5195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5592-5330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5656-5080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5684-5800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5704-5337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5728-5019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5740-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5764-5295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5784-5104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5816-5786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5836-5050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5888-5365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5896-5590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5936-5386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5944-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/5960-5541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6080-5850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6092-5134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6096-4916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                        memory/6116-4907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                        Download